165469 - XUL scrollbox crash mozilla 1.1 and 1.0

Status: RESOLVED DUPLICATE of bug 107518

(Core :: Web Painting, defect, P3)

Description

[Mathieu Dessus]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.0) Gecko/20020623 Debian/1.0.0-0.woody.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.0) Gecko/20020623 Debian/1.0.0-0.woody.1

Reading the previous page (you need to save it because this web server send it
as plain text) with Mozilla 1.0 or 1.1 under Linux (no other tested) makes
Mozilla hang.
Seems to come from the scrollbox

Reproducible: Always

Steps to Reproduce:
1. Just load that page as an XUL-interpreted document.

Actual Results:  
Mozilla crashes.


Seems to look close to bug 107518 ?

Comment 1

[Olav Vitters]

Attachment: Testcase

Comment 2

[Ian Graham]

Confirmed. Testcase in comment 97189 blows me out of the water, and on Win2k.
Changed OS to all.  Can't dump talkback, unfortunately, as my firewall won't 
let it through. 

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826

Comment 3

[Boris Zbarsky [:bzbarsky]]

#0  0x41efa959 in nsViewManager::UpdateView (this=0x8765318, aView=0x0, 
    aRect=@0xbfffd610, aUpdateFlags=4) at nsViewManager.cpp:1585
#1  0x41efc9c6 in nsViewManager::MoveViewTo (this=0x8765318, aView=0x8706e50, aX=0, 
    aY=308) at nsViewManager.cpp:2368
#2  0x424943b6 in nsContainerFrame::PositionFrameView (aPresContext=0x8764fa8, 
    aKidFrame=0x8692128) at nsContainerFrame.cpp:496
#3  0x42494f22 in nsContainerFrame::PositionChildViews (aPresContext=0x8764fa8, 
    aFrame=0x8692018) at nsContainerFrame.cpp:861
#4  0x42606456 in nsBox::SetBounds (this=0x8692050, aState=@0xbfffdf90, 
    aRect=@0xbfffd770) at nsBox.cpp:604
#5  0x42610907 in nsSprocketLayout::Layout (this=0x8332de0, aBox=0x879df60, 
    aState=@0xbfffdf90) at nsSprocketLayout.cpp:492
#6  0x4260e9a7 in nsContainerBox::DoLayout (this=0x879df60, aState=@0xbfffdf90)
    at nsContainerBox.cpp:605
#7  0x42621289 in nsBoxFrame::DoLayout (this=0x879df28, aState=@0xbfffdf90)
    at nsBoxFrame.cpp:1210
#8  0x426075e1 in nsBox::Layout (this=0x879df60, aState=@0xbfffdf90) at
nsBox.cpp:1060
#9  0x42610a43 in nsSprocketLayout::Layout (this=0x8332de0, aBox=0x879ddac, 
    aState=@0xbfffdf90) at nsSprocketLayout.cpp:524
#10 0x4260e9a7 in nsContainerBox::DoLayout (this=0x879ddac, aState=@0xbfffdf90)
    at nsContainerBox.cpp:605
#11 0x42621289 in nsBoxFrame::DoLayout (this=0x879dd74, aState=@0xbfffdf90)
    at nsBoxFrame.cpp:1210
#12 0x426075e1 in nsBox::Layout (this=0x879ddac, aState=@0xbfffdf90) at
nsBox.cpp:1060
#13 0x425f6c7b in nsScrollBoxFrame::DoLayout (this=0x879dc34, aState=@0xbfffdf90)
    at nsScrollBoxFrame.cpp:392
#14 0x426075e1 in nsBox::Layout (this=0x879dc6c, aState=@0xbfffdf90) at
nsBox.cpp:1060
#15 0x42610a43 in nsSprocketLayout::Layout (this=0x8332de0, aBox=0x878e018, 
    aState=@0xbfffdf90) at nsSprocketLayout.cpp:524
#16 0x4260e9a7 in nsContainerBox::DoLayout (this=0x878e018, aState=@0xbfffdf90)
    at nsContainerBox.cpp:605
#17 0x42621289 in nsBoxFrame::DoLayout (this=0x878dfe0, aState=@0xbfffdf90)
    at nsBoxFrame.cpp:1210

and so on

(gdb) frame 0
#0  0x41efa959 in nsViewManager::UpdateView (this=0x8765318, aView=0x0, 
    aRect=@0xbfffd610, aUpdateFlags=4) at nsViewManager.cpp:1585
1585      view->GetClippedRect(clippedRect, isClipped, isEmpty);
(gdb) p view
$14 = (nsView *) 0x0
(gdb) frame 1
#1  0x41efc9c6 in nsViewManager::MoveViewTo (this=0x8765318, aView=0x8706e50, aX=0, 
    aY=308) at nsViewManager.cpp:2368
2368          UpdateView(parentView, oldArea, NS_VMREFRESH_NO_SYNC);
(gdb) p view
$15 = (nsView *) 0x8706e50
(gdb) p parentView
$16 = (nsView *) 0x0
(gdb) p view->GetParent()
$17 = (nsView *) 0x0
(gdb) p *view
$18 = {<nsIView> = {<nsISupports> = {_vptr.nsISupports = 0x41f05020}, <No data
fields>}, 
  mViewManager = 0x8765318, mParent = 0x0, mWindow = 0x8706ad8, mZParent = 0x0, 
  mNextSibling = 0x0, mFirstChild = 0x8722288, mClientData = 0x8692128, mZIndex
= 0, 
  mVis = nsViewVisibility_kShow, mNumKids = 1, mPosX = 0, mPosY = 308,
mDimBounds = {
    x = 0, y = 308, width = 0, height = 0}, mChildClip = {x = 0, y = 0, width = 0, 
    height = 0}, mOpacity = 1, mVFlags = 4, mDirtyRegion = 0x0, mCompositorFlags
= 0, 
  mShouldIgnoreSetPosition = 0 '\0', mChildRemoved = 0 '\0'}

So why are we trying to move a view that has no parent exactly?

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Could this be related to bug 151826?

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I'm guessing it's the same issue. That issue is a bug in the way XUL constructs
frames and views.

Comment 6

[Jeff Walden [:Waldo]]

Still crashing for me.  I don't have access to a Talkback-enabled build because
I don't have Linux working on my computer yet.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040328
Firefox/0.8.0+

Comment 7

[Neil Paris]

Crash. Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040316

Talkback ID is TB10322W
Captured at 04/01/04 at 11:42 PM

Comment 8

[Jay Patel [:jay]]

*** This bug has been marked as a duplicate of 107518 ***