187890 - Crash scrolling page scottcollins.net - Trunk [@ IsCanvasFrame ][@ nsCSSRendering::FindBackgound]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Olivier Cahagne]

Build ID: 20030105

Steps to reproduce:
1. Load URL http://www.scottcollins.net/ ,
2. Scroll page with wheel mouse,
3. Mozilla crashes.

Talkback ID: TB15837977W.

Comment 1

[Nicholas Allen]

IsCanvasFrame(nsIFrame * 0x02dce954) line 2473 + 16 bytes
nsCSSRendering::FindBackground(nsIPresContext * 0x02736830, nsIFrame * 
0x02dce954, const nsStyleBackground * * 0x0012f4c4, int * 0x0012f4c8) line 2612 
+ 8 bytes
ApplyRenderingChangeToTree(nsIPresContext * 0x02736830, nsIFrame * 0x02dce954, 
nsIViewManager * 0x00000000, nsChangeHint 0x0000005e) line 10149 + 15 bytes
nsCSSFrameConstructor::ProcessRestyledFrames(nsCSSFrameConstructor * const 
0x010246d0, nsStyleChangeList & {...}, nsIPresContext * 0x02736830) line 10336 
+ 15 bytes
nsCSSFrameConstructor::ContentStatesChanged(nsCSSFrameConstructor * const 
0x010246d0, nsIPresContext * 0x00000000, nsIContent * 0x02b5b640, nsIContent * 
0x00000000, int 0x0000005e) line 10506
StyleSetImpl::ContentStatesChanged(StyleSetImpl * const 0x02cd9ea0, 
nsIPresContext * 0x02736830, nsIContent * 0x02b5b640, nsIContent * 0x00000000, 
int 0x00000004) line 1633
PresShell::ContentStatesChanged(PresShell * const 0x02b0ec70, nsIDocument * 
0x02cf1880, nsIContent * 0x02b5b640, nsIContent * 0x00000000, int 0x00000004) 
line 5117
nsDocument::ContentStatesChanged(nsDocument * const 0x02cf1880, nsIContent * 
0x02b5b640, nsIContent * 0x00000000, int 0x00000004) line 2040
nsEventStateManager::SetContentState(nsEventStateManager * const 0x02cf1880, 
nsIContent * 0x00000000, int 0x00000004) line 3977
nsEventStateManager::GenerateMouseEnterExit(nsEventStateManager * const 
0x00000000, nsIPresContext * 0x02736830, nsGUIEvent * 0x0012fa54) line 2573
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x03c9e304, 
nsIPresContext * 0x02736830, nsEvent * 0x0012fa54, nsIFrame * 0x02ffef4c, 
nsEventStatus * 0x0012f988, nsIView * 0x02faf208) line 379
PresShell::HandleEventInternal(PresShell * const 0x00000000, nsEvent * 
0x0012fa54, nsIView * 0x02faf208, unsigned int 0x00000001, nsEventStatus * 
0x0012f988) line 6066
PresShell::HandleEvent(PresShell * const 0x03c9e2f0, nsIView * 0x02faf208, 
nsGUIEvent * 0x0012fa54, nsEventStatus * 0x0012f988, int 0x00000000, int & 
0x00000001) line 5992 + 18 bytes
nsViewManager::HandleEvent(nsViewManager * const 0x00000000, nsView * 
0x00000000, nsGUIEvent * 0x0012fa54, int 0x00000000) line 2209
nsView::HandleEvent(nsView * const 0x00000000, nsViewManager * 0x027ab0b8, 
nsGUIEvent * 0x0012fa54, int 0x00000000) line 304
nsViewManager::DispatchEvent(nsViewManager * const 0x027ab0b8, nsGUIEvent * 
0x02fccd78, nsEventStatus * 0x0012fa04) line 1943 + 30 bytes
HandleEvent(nsGUIEvent * 0x0012fa54) line 83
nsWindow::DispatchEvent(nsWindow * const 0x03f576c4, nsGUIEvent * 0x0012fa54, 
nsEventStatus & nsEventStatus_eIgnore) line 1120
nsWindow::DispatchWindowEvent(nsWindow * const 0x00000000, nsGUIEvent * 
0x00000000) line 1137
nsWindow::DispatchMouseEvent(nsWindow * const 0x00000000, unsigned int 
0x0000012c, unsigned int 0x00000000, nsPoint * 0x00000000) line 5378
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x00000000, unsigned int 
0x0000012c, unsigned int 0x00000000, nsPoint * 0x00000000) line 5632 + 19 bytes
nsWindow::ProcessMessage(nsWindow * const 0x00000000, unsigned int 0x00000200, 
unsigned int 0x00000000, long 0x00f3018a, long * 0x0012fd0c) line 4069
nsWindow::WindowProc(HWND__ * 0x005c0146, unsigned int 0x00000000, unsigned int 
0x00000000, long 0x03f576c4) line 1403 + 16 bytes
USER32! 77e3a244()
USER32! 77e145e5()
USER32! 77e1a792()
nsAppShellService::Run(nsAppShellService * const 0x02088948) line 472
main1(int 0x00000000, char * * 0x1004c0f8 const  nsObserverService::`vftable', 
nsISupports * 0x00000000) line 1543 + 9 bytes
main(int 0x00000001, char * * 0x002a2c30) line 1904 + 27 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x0013332f, 
HINSTANCE__ * 0x00400000) line 1926 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77ea847c()

Comment 2

[Nicholas Allen]

That was with a cvs trunk build from last night on Win2k.

Comment 3

[Nicholas Allen]

Playing around with this some more, I don't even need to scroll to crash the
page.  It sporadically crashes on load as well.

Comment 4

[Olivier Cahagne]

dupe of bug 141590 ?

Comment 5

[Olivier Cahagne]

same stack on Linux 20030105, OS -> All.

0x41c6ff1e in IsCanvasFrame (aFrame=0x8be65c8) at nsCSSRendering.cpp:2473
2473	  aFrame->GetFrameType(getter_AddRefs(frameType));
(gdb) bt
#0  0x41c6ff1e in IsCanvasFrame (aFrame=0x8be65c8) at nsCSSRendering.cpp:2473
#1  0x41b6f980 in nsCSSRendering::FindBackground (aPresContext=0x8957678, 
    aForFrame=0x8be65c8, aBackground=0xbfffdd1c, aIsCanvas=0xbfffdd20)
    at nsCSSRendering.cpp:2612

Comment 6

[Jay Patel [:jay]]

Although there aren't a lot of crashes being reported by Talkback, this crash is
in the top 40 for the MozillaTrunk and a couple of people have already
reproduced it...so adding topcrash, testcase keywords.

Comment 7

[Andrew Schultz]

this bug might be reproducible, but is still lacking a testcase

Comment 8

[Andrew Schultz]

this appears to have regressed between 2003010404 and 2003010505, implicating
bug 126072

==> stylesystem

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

->bz

Comment 10

[Boris Zbarsky [:bzbarsky]]

patch in bug 123049 fixes this.

Comment 11

[Andrew Schultz]

Attachment: testcase

mouseover 'foo' ==> crash

      <style>
	 a:hover { background-color: yellow; }
      </style>
      <dl>
	 <a>
	    <dd>
	    <p>foo</p>
	    </dd>
	 </a>
      </dl>

Comment 12

[Olivier Cahagne]

*** Bug 188050 has been marked as a duplicate of this bug. ***

Comment 13

[rbs]

-> fixed via bug 123049