148350 - Fix to 136441 causing (-O2) crash on startup. [@nsView::GetClippedRect]

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect)

Description

[Philip Langdale]

Though I cannot see why it could possibly happen, the fix recently checked in
for bug 136441 is causing a crash at startup.

After some fiddling, I have traced the cause of the crash to the first access of
the return value of the call to parentView->GetFloating() on line 1030.

ie: If I move the call out of the if() statement and assign it's return value to
a variable and then printf this var, it will provoke the crash. This type of
behaviour is strongly suggestive of a memory leak, but puzzles me because there
is no heap access going on in this function or it's return method.

Here is my backtrace. As it is not from a debug build, the trace stops when
entering nsView::GetClippedRect() but the actual point of failure is the printf
of the return value of parentView->GetFloating();

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 31227)]
0x4138c7da in nsView::GetClippedRect () from
/usr/lib/mozilla/components/libgkview.so
(gdb) backtrace
#0  0x4138c7da in nsView::GetClippedRect () from
/usr/lib/mozilla/components/libgkview.so
#1  0x41395a01 in nsViewManager::UpdateView () from
/usr/lib/mozilla/components/libgkview.so
#2  0x41399976 in nsViewManager::SetViewVisibility () from
/usr/lib/mozilla/components/libgkview.so
#3  0x41275703 in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#4  0x4127716d in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#5  0x4121924b in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#6  0x41202df7 in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#7  0x412074ba in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#8  0x41206f61 in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#9  0x41201be3 in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#10 0x412191df in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#11 0x4120358b in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#12 0x411fe7f5 in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#13 0x40de7222 in NSGetModule () from /usr/lib/mozilla/components/libgkcontent.so
#14 0x411a42c9 in NSGetModule () from /usr/lib/mozilla/components/libgklayout.so
#15 0x40c44aa7 in NSGetModule () from /usr/lib/mozilla/components/libgkcontent.so
#16 0x40c49931 in NSGetModule () from /usr/lib/mozilla/components/libgkcontent.so
#17 0x4095bbe3 in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#18 0x40958ea1 in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#19 0x40959bea in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#20 0x4095858d in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#21 0x40957559 in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#22 0x4096f57a in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#23 0x4096cde3 in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#24 0x4096f706 in NSGetModule () from /usr/lib/mozilla/components/libhtmlpars.so
#25 0x406478a9 in NSGetModule () from /usr/lib/mozilla/components/liburiloader.so
#26 0x4067d805 in NSGetModule () from /usr/lib/mozilla/components/libnecko.so
#27 0x4069cf9d in NSGetModule () from /usr/lib/mozilla/components/libnecko.so
#28 0x40687962 in NSGetModule () from /usr/lib/mozilla/components/libnecko.so
#29 0x4018d15e in PL_ProcessEventsBeforeID () from /usr/lib/mozilla/libxpcom.so
#30 0x407cf7a9 in NSGetModule () from /usr/lib/mozilla/components/libwidget_gtk.so
#31 0x40150ae2 in nsVoidArray::EnumerateForwards () from
/usr/lib/mozilla/libxpcom.so
#32 0x407cf7e3 in NSGetModule () from /usr/lib/mozilla/components/libwidget_gtk.so
#33 0x407d7235 in NSGetModule () from /usr/lib/mozilla/components/libwidget_gtk.so
#34 0x4037d127 in gdk_wm_protocols_filter () from /opt/gnome/lib/libgdk-1.2.so.0
#35 0x403ab308 in g_get_current_time () from /opt/gnome/lib/libglib-1.2.so.0
#36 0x403ab913 in g_get_current_time () from /opt/gnome/lib/libglib-1.2.so.0
#37 0x403abaac in g_main_run () from /opt/gnome/lib/libglib-1.2.so.0
#38 0x402ce7e7 in gtk_main () from /opt/gnome/lib/libgtk-1.2.so.0
#39 0x407cf6f2 in NSGetModule () from /usr/lib/mozilla/components/libwidget_gtk.so
#40 0x407af7b0 in NSGetModule () from /usr/lib/mozilla/components/libnsappshell.so
#41 0x08051c93 in getCountry ()
#42 0x080525b2 in main ()
#43 0x404be17d in __libc_start_main (main=0x8052418 <main>, argc=1,
ubp_av=0xbffff394, init=0x804c0c0 <_init>, fini=0x8053c80 <_fini>, 
    rtld_fini=0x4000a534 <_dl_fini>, stack_end=0xbffff38c) at
../sysdeps/generic/libc-start.c:129

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

That is baffling. My changes don't seem to add any memory references that we
weren't going to do anyway.

In gdb, can you do a "disasm" and an "info registers" to give me a clearer idea
of what could be happening there?

Did you build this yourself or is it a nightly build?

Comment 2

[Nicolás Lichtmaier]

0x41dd2d10 <GetClippedRect__C6nsViewR6nsRectRiT2>:      push   %ebp

0x41dd2d11 <GetClippedRect__C6nsViewR6nsRectRiT2+1>:    mov    %esp,%ebp

0x41dd2d13 <GetClippedRect__C6nsViewR6nsRectRiT2+3>:    sub    $0x3c,%esp

0x41dd2d16 <GetClippedRect__C6nsViewR6nsRectRiT2+6>:    push   %edi

0x41dd2d17 <GetClippedRect__C6nsViewR6nsRectRiT2+7>:    push   %esi

0x41dd2d18 <GetClippedRect__C6nsViewR6nsRectRiT2+8>:    push   %ebx

0x41dd2d19 <GetClippedRect__C6nsViewR6nsRectRiT2+9>:    

    call   0x41dd2d1e <GetClippedRect__C6nsViewR6nsRectRiT2+14>

0x41dd2d1e <GetClippedRect__C6nsViewR6nsRectRiT2+14>:   pop    %ebx

0x41dd2d1f <GetClippedRect__C6nsViewR6nsRectRiT2+15>:   add$0x18ab2,%ebx

0x41dd2d25 <GetClippedRect__C6nsViewR6nsRectRiT2+21>:   mov0x8(%ebp),%esi

0x41dd2d28 <GetClippedRect__C6nsViewR6nsRectRiT2+24>:   

    movl   $0x0,0xffffffdc(%ebp)

0x41dd2d2f <GetClippedRect__C6nsViewR6nsRectRiT2+31>:   

    movl   $0x0,0xffffffd8(%ebp)

0x41dd2d36 <GetClippedRect__C6nsViewR6nsRectRiT2+38>:   mov0x14(%ebp),%eax

0x41dd2d39 <GetClippedRect__C6nsViewR6nsRectRiT2+41>:   movl   $0x0,(%eax)

0x41dd2d3f <GetClippedRect__C6nsViewR6nsRectRiT2+47>:   mov0x10(%ebp),%edx 

0x41dd2d42 <GetClippedRect__C6nsViewR6nsRectRiT2+50>:   movl   $0x0,(%edx)

0x41dd2d48 <GetClippedRect__C6nsViewR6nsRectRiT2+56>:   add$0xfffffff8,%esp

0x41dd2d4b <GetClippedRect__C6nsViewR6nsRectRiT2+59>:   mov    (%esi),%eax

0x41dd2d4d <GetClippedRect__C6nsViewR6nsRectRiT2+61>:   mov    0xc(%ebp),%ecx

0x41dd2d50 <GetClippedRect__C6nsViewR6nsRectRiT2+64>:   push   %ecx

0x41dd2d51 <GetClippedRect__C6nsViewR6nsRectRiT2+65>:   push   %esi 

0x41dd2d52 <GetClippedRect__C6nsViewR6nsRectRiT2+66>:   mov0x24(%eax),%eax

0x41dd2d55 <GetClippedRect__C6nsViewR6nsRectRiT2+69>:   call   *%eax

0x41dd2d57 <GetClippedRect__C6nsViewR6nsRectRiT2+71>:   add    $0x10,%esp

0x41dd2d5a <GetClippedRect__C6nsViewR6nsRectRiT2+74>:   mov0x8(%esi),%edi

0x41dd2d5d <GetClippedRect__C6nsViewR6nsRectRiT2+77>:   mov0x58(%esi),%eax

0x41dd2d60 <GetClippedRect__C6nsViewR6nsRectRiT2+80>:   shr    $0x6,%eax

0x41dd2d63 <GetClippedRect__C6nsViewR6nsRectRiT2+83>:   and$0x1,%eax

0x41dd2d66 <GetClippedRect__C6nsViewR6nsRectRiT2+86>:   test   %edi,%edi

0x41dd2d68 <GetClippedRect__C6nsViewR6nsRectRiT2+88>:   

    je     0x41dd2e20 <GetClippedRect__C6nsViewR6nsRectRiT2+272>

0x41dd2d6e <GetClippedRect__C6nsViewR6nsRectRiT2+94>:   mov    0x58(%edi),%edx

0x41dd2d71 <GetClippedRect__C6nsViewR6nsRectRiT2+97>:   

    jmp    0x41dd2e0f <GetClippedRect__C6nsViewR6nsRectRiT2+255>

0x41dd2d76 <GetClippedRect__C6nsViewR6nsRectRiT2+102>:  test   $0x2,%dh

0x41dd2d79 <GetClippedRect__C6nsViewR6nsRectRiT2+105>:  

    je     0x41dd2df0 <GetClippedRect__C6nsViewR6nsRectRiT2+224>

0x41dd2d7b <GetClippedRect__C6nsViewR6nsRectRiT2+107>:  mov0x10(%ebp),%eax 

0x41dd2d7e <GetClippedRect__C6nsViewR6nsRectRiT2+110>:  movl   $0x1,(%eax)

0x41dd2d84 <GetClippedRect__C6nsViewR6nsRectRiT2+116>:  add    $0xfffffff4,%esp

0x41dd2d87 <GetClippedRect__C6nsViewR6nsRectRiT2+119>:  mov    (%edi),%edx

0x41dd2d89 <GetClippedRect__C6nsViewR6nsRectRiT2+121>:  

    lea    0xffffffec(%ebp),%eax

0x41dd2d8c <GetClippedRect__C6nsViewR6nsRectRiT2+124>:  push   %eax

0x41dd2d8d <GetClippedRect__C6nsViewR6nsRectRiT2+125>:  

    lea    0xffffffe8(%ebp),%eax

0x41dd2d90 <GetClippedRect__C6nsViewR6nsRectRiT2+128>:  push   %eax

0x41dd2d91 <GetClippedRect__C6nsViewR6nsRectRiT2+129>:  

    lea    0xffffffe4(%ebp),%eax

0x41dd2d94 <GetClippedRect__C6nsViewR6nsRectRiT2+132>:  push   %eax

0x41dd2d95 <GetClippedRect__C6nsViewR6nsRectRiT2+133>:  

    lea    0xffffffe0(%ebp),%eax

0x41dd2d98 <GetClippedRect__C6nsViewR6nsRectRiT2+136>:  push   %eax

0x41dd2d99 <GetClippedRect__C6nsViewR6nsRectRiT2+137>:  push   %edi

0x41dd2d9a <GetClippedRect__C6nsViewR6nsRectRiT2+138>:  mov    0x7c(%edx),%eax

0x41dd2d9d <GetClippedRect__C6nsViewR6nsRectRiT2+141>:  call   *%eax

0x41dd2d9f <GetClippedRect__C6nsViewR6nsRectRiT2+143>:  add    $0x20,%esp

0x41dd2da2 <GetClippedRect__C6nsViewR6nsRectRiT2+146>:  

    mov    0xffffffe0(%ebp),%edx

0x41dd2da5 <GetClippedRect__C6nsViewR6nsRectRiT2+149>:

    mov    0xffffffdc(%ebp),%ecx

0x41dd2da8 <GetClippedRect__C6nsViewR6nsRectRiT2+152>:  add%edx,%ecx

0x41dd2daa <GetClippedRect__C6nsViewR6nsRectRiT2+154>:  

    mov    %ecx,0xfffffff0(%ebp)

0x41dd2dad <GetClippedRect__C6nsViewR6nsRectRiT2+157>:

    mov    0xffffffe4(%ebp),%eax

0x41dd2db0 <GetClippedRect__C6nsViewR6nsRectRiT2+160>:

    mov    0xffffffd8(%ebp),%ecx

0x41dd2db3 <GetClippedRect__C6nsViewR6nsRectRiT2+163>:  add%eax,%ecx

0x41dd2db5 <GetClippedRect__C6nsViewR6nsRectRiT2+165>:  

    mov    %ecx,0xfffffff4(%ebp)

0x41dd2db8 <GetClippedRect__C6nsViewR6nsRectRiT2+168>:

    mov    0xffffffe8(%ebp),%ecx

0x41dd2dbb <GetClippedRect__C6nsViewR6nsRectRiT2+171>:  sub%edx,%ecx

0x41dd2dbd <GetClippedRect__C6nsViewR6nsRectRiT2+173>:  

    mov    %ecx,0xfffffff8(%ebp)

0x41dd2dc0 <GetClippedRect__C6nsViewR6nsRectRiT2+176>:

    mov    0xffffffec(%ebp),%edx

0x41dd2dc3 <GetClippedRect__C6nsViewR6nsRectRiT2+179>:  sub%eax,%edx

0x41dd2dc5 <GetClippedRect__C6nsViewR6nsRectRiT2+181>:  

    mov    %edx,0xfffffffc(%ebp)

0x41dd2dc8 <GetClippedRect__C6nsViewR6nsRectRiT2+184>:  add$0xfffffffc,%esp

0x41dd2dcb <GetClippedRect__C6nsViewR6nsRectRiT2+187>:  mov0xc(%ebp),%ecx  

0x41dd2dce <GetClippedRect__C6nsViewR6nsRectRiT2+190>:  push   %ecx

0x41dd2dcf <GetClippedRect__C6nsViewR6nsRectRiT2+191>:  

    lea    0xfffffff0(%ebp),%eax

0x41dd2dd2 <GetClippedRect__C6nsViewR6nsRectRiT2+194>:  push   %eax

0x41dd2dd3 <GetClippedRect__C6nsViewR6nsRectRiT2+195>:  push   %ecx

0x41dd2dd4 <GetClippedRect__C6nsViewR6nsRectRiT2+196>:  

    call   0x41dd0ba4 <_init+392>

0x41dd2dd9 <GetClippedRect__C6nsViewR6nsRectRiT2+201>:  add$0x10,%esp

0x41dd2ddc <GetClippedRect__C6nsViewR6nsRectRiT2+204>:  test   %eax,%eax 

0x41dd2dde <GetClippedRect__C6nsViewR6nsRectRiT2+206>:  

    jne    0x41dd2df0 <GetClippedRect__C6nsViewR6nsRectRiT2+224>

0x41dd2de0 <GetClippedRect__C6nsViewR6nsRectRiT2+208>:  mov    0x14(%ebp),%eax

0x41dd2de3 <GetClippedRect__C6nsViewR6nsRectRiT2+211>:  movl   $0x1,(%eax)

0x41dd2de9 <GetClippedRect__C6nsViewR6nsRectRiT2+217>:  

    jmp    0x41dd2e20 <GetClippedRect__C6nsViewR6nsRectRiT2+272>

0x41dd2deb <GetClippedRect__C6nsViewR6nsRectRiT2+219>:  nop     

0x41dd2dec <GetClippedRect__C6nsViewR6nsRectRiT2+220>:  lea    0x0(%esi,1),%esi

0x41dd2df0 <GetClippedRect__C6nsViewR6nsRectRiT2+224>:  mov    0x2c(%edi),%edx 

0x41dd2df3 <GetClippedRect__C6nsViewR6nsRectRiT2+227>:  

    sub    %edx,0xffffffdc(%ebp)

0x41dd2df6 <GetClippedRect__C6nsViewR6nsRectRiT2+230>:  mov0x30(%edi),%ecx

0x41dd2df9 <GetClippedRect__C6nsViewR6nsRectRiT2+233>:  

    sub    %ecx,0xffffffd8(%ebp)

0x41dd2dfc <GetClippedRect__C6nsViewR6nsRectRiT2+236>:  mov0x58(%edi),%eax

0x41dd2dff <GetClippedRect__C6nsViewR6nsRectRiT2+239>:  shr$0x6,%eax

0x41dd2e02 <GetClippedRect__C6nsViewR6nsRectRiT2+242>:  and$0x1,%eax

0x41dd2e05 <GetClippedRect__C6nsViewR6nsRectRiT2+245>:  mov0x8(%edi),%edi

0x41dd2e08 <GetClippedRect__C6nsViewR6nsRectRiT2+248>:  mov0x58(%edi),%edx <-- crash!

0x41dd2e0b <GetClippedRect__C6nsViewR6nsRectRiT2+251>:  test   %edi,%edi

0x41dd2e0d <GetClippedRect__C6nsViewR6nsRectRiT2+253>:  

    je     0x41dd2e20 <GetClippedRect__C6nsViewR6nsRectRiT2+272>

0x41dd2e0f <GetClippedRect__C6nsViewR6nsRectRiT2+255>:  test   %eax,%eax

0x41dd2e11 <GetClippedRect__C6nsViewR6nsRectRiT2+257>:  

    je     0x41dd2d76 <GetClippedRect__C6nsViewR6nsRectRiT2+102>

0x41dd2e17 <GetClippedRect__C6nsViewR6nsRectRiT2+263>:  test   $0x40,%dl

0x41dd2e1a <GetClippedRect__C6nsViewR6nsRectRiT2+266>:  

    jne    0x41dd2d76 <GetClippedRect__C6nsViewR6nsRectRiT2+102>

0x41dd2e20 <GetClippedRect__C6nsViewR6nsRectRiT2+272>:  xor    %eax,%eax

0x41dd2e22 <GetClippedRect__C6nsViewR6nsRectRiT2+274>:  

    lea    0xffffffb8(%ebp),%esp

0x41dd2e25 <GetClippedRect__C6nsViewR6nsRectRiT2+277>:  pop%ebx

0x41dd2e26 <GetClippedRect__C6nsViewR6nsRectRiT2+278>:  pop%esi

0x41dd2e27 <GetClippedRect__C6nsViewR6nsRectRiT2+279>:  pop%edi

0x41dd2e28 <GetClippedRect__C6nsViewR6nsRectRiT2+280>:  leave  

0x41dd2e29 <GetClippedRect__C6nsViewR6nsRectRiT2+281>:  ret    



Registers:

eax       0x00

ecx       0x00

edx       0x00

ebx       0x41deb7d0       1105115088

esp       0xbfffdfb40xbfffdfb4

ebp       0xbfffdffc0xbfffdffc

esi       0x8413378 138490744 

edi       0x0      0

eip       0x41dd2e080x41dd2e08

eflags    0x10246  66118

cs        0x23     35   

ss        0x2b     43   

ds        0x2b     43   

es        0x2b     43   

fs        0x0      0    

gs        0x0      0    

orig_eax  0xffffffff       -1



Local variables:

this = (nsView *) 0x8413378

ancestorX = 0

ancestorY = 0

parentView = (nsView *) 0x0

lastViewIsFloating = 0



*this:

{<nsIView> = {<nsISupports> = {

      _vptr. = 0x41deaa20 <nsView virtual table>}, <No data fields>},

  mViewManager = 0x83f8c20, mParent = 0x83f8ee8, mWindow = 0x0, 

  mZParent = 0x0, mNextSibling = 0x0, mFirstChild = 0x0, mClientData = 0x0,

  mZIndex = 0, mVis = nsViewVisibility_kShow, mNumKids = 0, mPosX = 0, 

  mPosY = 0, mDimBounds = {x = 0, y = 0, width = 0, height = 0}, mChildClip = {

    mLeft = 0, mRight = 0, mTop = 0, mBottom = 0}, mOpacity = 1, mVFlags = 0,  

  mDirtyRegion = 0x0, mCompositorFlags = 0, mShouldIgnoreSetPosition = 0 '\0', 

  mChildRemoved = 0 '\0'}

Comment 3

[Brian Ryner (not reading)]

What gcc version are you using?  I don't see a startup crash on my -O2 build
using gcc-2.96-110.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: Annotated assembler listing that points out the compiler bug

See my comments in the disassembly. In particular, at 0x41dd2e08 the compiler
is fetching parentView->mViewFlags before the test to see whether parentView is
null. Obviously the flags are not supposed to be loaded and tested until after
the null check. I suspect the problem has something to do with the common
subexpression elimination that merged code from the statements
"lastViewIsFloating = GetFloating();" and "lastViewIsFloating =
parentView->GetFloating()".

Comment 5

[Nicolás Lichtmaier]

Attachment: fix

This fixes it for me. The patch does other things because I've started to do
random modifications to see if the crash disappeared =).

Comment 6

[Nicolás Lichtmaier]

Attachment: better fix

here it is

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 85838 [details] [diff] [review]
better fix

I can live with that.
r=roc+moz

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

On what gcc version was this bug seen?  Was it in the nightly builds?  (Which ones?)

Has anyone filed a gcc bug, if it's a problem in a current gcc?

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I only know what nick said about his build, which was:

> <nick> Debian's
> <nick> gcc version 2.95.4 20011002

Didn't seem to impact any tinderboxen.

Comment 10

[Philip Langdale]

This patch fixes the problem for me too.

I guess I can't do an SR, but it's got my approval. :-)

I was building gcc 2.95.3 -O4, which is probably crazy but it's worked until now.

Naturally I'm building the trunk from cvs.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

It's really good that people are building regularly with high optimization
levels. It makes it much easier to track down stuff like this...

Comment 12

[Nicolás Lichtmaier]

I've reproduced it with just -O2. I then removed nsView.o and built without -O,
the crash disappeared.
Perhaps a comment should be put there stating what happened.

Comment 13

[hacker formerly known as [e-mail]]

Btw, this did affect the myotonic tinderbox which builds using gcc 2.95.3 with -O2.

Comment 14

[jag (Peter Annema)]

Comment on attachment 85838 [details] [diff] [review]
better fix

sr=jag

Silly compilers

Comment 15

[Robert O'Callahan (:roc) (email my personal email if necessary)]

seawood: actually, yes, it did nail mytotonic now that I look at it.

Nick: do you have CVS checkin privileges? If so please go ahead and check this
into the trunk. If not let me know and I'll check it in.

Comment 16

[Nicolás Lichtmaier]

Me? Commit access? naah... :)

Comment 17

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Be careful: if you send in too many patches, someone might give you CVS access...

I will check this in.

Comment 18

[Roland Mainz]

Robert O'Callahan wrote:
> Be careful: if you send in too many patches, someone might give you CVS 
> access...

Really ? AFAIK I filed ~~250 patches... is that enougth ? :)

Comment 19

[R.K.Aa.]

FWIW: I build with -O2 and do not see any crash. (RH7.3)

Comment 20

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 85838 [details] [diff] [review]
better fix

In conjunction with the patch for bug 136441, please check into the 1.0.1
branch ASAP. once landed remove the 
mozilla1.0.1+ keyword and add the fixed1.0.1 keyword

Comment 21

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fix checked in on trunk.

Comment 22

[Aleksey Nogin]

This commit have added a warning on brad TBox:

+view/src/nsView.cpp:1026
+ `PRBool parentIsFloating' might be used uninitialized in this function

In indeed appeares to be a bug - if lastViewIsFloating is false, then

while (parentView && (!lastViewIsFloating || (parentIsFloating =
parentView->GetFloating()))) 

may end up not setting parentIsFloating (but it will still be used!).

Is it worth filing a new bug for this?

Comment 23

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Oops

Let's fix it here.

Comment 24

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: Fix the warning

You chaps who saw this crash should try this patch and make sure it doesn't
trigger any optimizer bugs...

Comment 25

[Kevin McCluskey (gone)]

Comment on attachment 86206 [details] [diff] [review]
Fix the warning

r=[e-mail]

Comment 26

[Jarmo]

*** Bug 148601 has been marked as a duplicate of this bug. ***

Comment 27

[Chris Waterson]

Comment on attachment 86206 [details] [diff] [review]
Fix the warning

sr=waterson

Comment 28

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Could one of you gcc 2.95.3 users please check that this patch doesn't crash for
you? Thanks!

Comment 29

[hacker formerly known as [e-mail]]

Comment on attachment 86206 [details] [diff] [review]
Fix the warning

wfm.

Comment 30

[Philip Langdale]

2.95.3 WORKSFORME

Comment 31

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fix checked in.

Comment 32

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 86206 [details] [diff] [review]
Fix the warning

approval includes this too

Comment 33

[Randell Jesup [:jesup] (needinfo me)]

Marking fixed1.0.1 since it seems someone checked it into the branch without
noting that here.

Comment 34

[Terri Preston]

Verified fixed linux branch build 2002082606, marking verified1.0.1