170549 - Crash when browser auto scrolls (bookmark manager) [@ nsTreeBodyFrame::CanAutoScroll] in Trunk, M1.2a

Status: VERIFIED DUPLICATE of bug 170249

(Core :: XUL, defect)

Description

[greer]

A couple of the XUL UI's (notably the bookmark manager) are showing crashes when
they enter into an auto scrolling behavior. 

Looking at the registers, we may be trying to pass a null value.

EAX: 00000000 EBX: 0178a788 ECX: 023b3818 EDX: 0012fe18
ESI: 023b3818 EDI: 02499fa0 ESP: 0012fe08 EBP: 0012fe1c
EIP: 60766654 cf PF af zf sf of IF df nt RF vm   IOPL: 0
CS: 001b DS: 0023 SS: 0023 ES: 0023 FS: 0038 GS: 0000

Code Around the PC:
60766654 8b08             mov     ecx,[eax]  <== crashes here
60766656 ff510c           call    dword ptr [ecx+0xc]
60766659 8b45fc           mov     eax,[ebp-0x4]
6076665c 8b7d08           mov     edi,[ebp+0x8]
6076665f 8d50ff           lea     edx,[eax-0x1]
60766662 3bfa             cmp     edi,edx
60766664 7524             jnz     6076668a
60766666 8b8e90000000     mov     ecx,[esi+0x90]
6076666c 8bc7             mov     eax,edi
6076666e 2b4678           sub     eax,[esi+0x78]
60766671 0fafc1           imul    eax,ecx
Stack Trace: 

	 nsTreeBodyFrame::CanAutoScroll
[c:/builds/seamonkey/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp 
line 3600]
	 nsTreeBodyFrame::ScrollCallback
[c:/builds/seamonkey/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp 
line 3718]
	 nsTimerImpl::Fire	[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp 
line 368]
	 nsTimerManager::FireNextIdleTimer
[c:/builds/seamonkey/mozilla/xpcom/threads/nsTimerImpl.cpp  line 591]
	 nsAppShell::Run	[c:/builds/seamonkey/mozilla/widget/src/windows/nsAppShell.cpp
 line 156]
	 nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp  line 472]
	 main1	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1524]
	 main	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1871]
	 WinMain	[c:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp  line 1889]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x1b560 (0xbff8b560)
	 KERNEL32.DLL + 0x1b412 (0xbff8b412)
	 KERNEL32.DLL + 0x19dd5 (0xbff89dd5)
 
 	Source File :
c:/builds/seamonkey/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
line : 3600
     (11400931)	Comments: Scrolling up whilst managing my  bookmarks
     (11393045)	URL: http://www.guppys.com/eboard/index.cgi
     (11393045)	Comments: Did a cut and paste while editing bookmarks. Was also
loading a page for view.
     (11369511)	URL: http://www.morpheus-os.com/
     (11337149)	Comments: Trying to rearrange bookmarks by dragging and dropping 
     (11327901)	Comments: Moving bookmarks inside manage bookmarks
     (11301076)	Comments: In the Bookmark Manager  I tried to drag a bookmark
into the IE Favorites folder. The mouse pointer changed into a crossed out O 
and the bookmark window started scrolling upwards. The scrolling didn't stop
when I dropped the bookmark. (let go of the
     (11301076)	Comments:  mouse button) When I tried to close the Bookmark
Manager  Mozilla crashed.
     (11254892)	Comments: when I try to move up a link on the bookmark manager
it starts to scroll on its own. and when I exit the manager mozilla crashes
     (11254745)	Comments: using the bookmark manager. the scroll bar started to
act on its own
     (11241539)	Comments: Attempted to move back in the history from a displayed
pdf document. 
     (11168124)	Comments: bombed as I closed the address book which was
exhibiting strange (scrolling up and down the address list on its own)
     (11157592)	Comments: Moving mail from Trash back into Inbox.
     (11137480)	Comments: Trying to manage bookmarks in a link opened from an
IMAP mail message.  Moving a folder around.
     (11081426)	Comments: managing bookmarks  I created a new folder and named
it Ruby  Then it appears at the top of the bookmarklist  I  marked  it with one
click and tried to move it down to the bottom of the list.  the it crashed
     (10964624)	URL: http://www.maths.tcd.ie/~bonds
     (10964624)	Comments: Moving a folder in 'Manage Your Bookmarks'
     (10929508)	Comments: Crashed while attempting to scroll while editing
Bookmarks.  Scrolling down to get to the bottom of the bookmarks doesn't appear
to work correctly so I was attempting to edit bookmarks to put them into folders
so I wouldn't have to scroll.  Scrolling in
     (10929508)	Comments:  the edit bookmark window didn't work correctly and
crashed Mozilla. 
     (10905183)	Comments: About:config info in tab was scrolling on it's own
(without any intervention from me).  Closed the tab to go to another one and
browser crashed.

Comment 1

[greer]

Who's taking Hyatt's bugs? Blake?

Comment 2

[Kyle Yuan]

*** This bug has been marked as a duplicate of 170249 ***

Comment 3

[greer]

Thanks, Kyle.