191336 - Crash with nsFrame::Invalidate

Status: RESOLVED INCOMPLETE

(Core :: Graphics: ImageLib, defect, P2)

Description

[Scott Corscadden]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.3a) Gecko/20021212
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.3a) Gecko/20021212

Happens with closing a tab window via Apple-W, also when opening a new tab via
control-click. I don't think it's related to <a
href="http://bugzilla.mozilla.org/show_bug.cgi?id=186932">186932</a>

Reproducible: Sometimes

Steps to Reproduce:
1. Go to slashdot
2. Control-click on various links to open tabs
3. Eventually, you'll crash

Actual Results:  
Got angry. Looked at stack trace, which is pasted in the Additional information
part.



Expected Results:  
Probably not crashed =)

**********

Date/Time:  2003-01-30 13:46:12 -0500
OS Version: 10.2.3 (Build 6G30)
Host:       Scott-Corscaddens-Computer.local.

Command:    Mozilla
PID:        29682

Exception:  EXC_BAD_INSTRUCTION (0x0002)
Code[0]:    0x00000002
Code[1]:    0x0426d284

Thread 0 Crashed:
 #0   0x0426d284 in 0x426d284
 #1   0x02df74ec in nsFrame::Invalidate( const(nsIPresContext *, nsRect const &,
int))
 #2   0x02e7f17c in nsImageFrame::FrameChanged(imgIContainer *, nsIPresContext *)
 #3   0x02e856f0 in nsImageListener::FrameChanged(imgIContainer *, nsISupports *)
 #4   0x02ab6e88 in FrameChanged__15imgRequestProxyFP13imgIContainerP14gfxIImageFr
 #5   0x02ab44d0 in FrameChanged__10imgRequestFP13imgIContainerP11nsISupportsP14gf
 #6   0x02ac5d1c in imgContainerGIF::Notify(nsITimer *)
 #7   0x00306fb0 in nsTimerImpl::Fire(void)
 #8   0x003070dc in handleTimerEvent(TimerEventType *)
 #9   0x002d3030 in PL_HandleEvent
 #10  0x002d2e9c in PL_ProcessPendingEvents
 #11  0x0027ab3c in nsEventQueueImpl::ProcessPendingEvents(void)
 #12  0x02602e8c in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void)
 #13  0x02602d30 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &)
 #14  0x01ef6b14 in Repeater::DoRepeaters(EventRecord const &)
 #15  0x02619ab8 in nsMacMessagePump::DispatchEvent(int, EventRecord *)
 #16  0x026197f0 in nsMacMessagePump::DoMessagePump(void)
 #17  0x026190fc in nsAppShell::Run(void)
 #18  0x025d124c in nsAppShellService::Run(void)
 #19  0x001a51b4 in main1(int, char **, nsISupports *)
 #20  0x001a5c0c in main

Comment 1

[Scott Corscadden]

Attachment: Stack trace

Stack Trace

Comment 2

[Matthias Versen [:Matti]]

-> Layout

Comment 3

[Kevin McCluskey (gone)]

-> ImageLib

Comment 4

[David G King]

I'm not sure if this is related, but I'm getting WARNING's from
nsFrame::Invalidate with a debug build (pulled today 25/6 NZST) on WinXP. The
warning happens if aDamageRect.IsEmpty() is true (and you're running a debug build).

http://lxr.mozilla.org/seamonkey/source/layout/html/base/src/nsFrame.cpp#2659

Comment 5

[Jesse Ruderman]

I bet this was fixed somewhere else, but the steps-to-reproduce are too generic to be sure.  nsFrame::Invalidate doesn't even exist any more.

Comment 6

[Jesse Ruderman]

(The warning in comment 4 was removed in bug 233292, fwiw)