Closed Bug 202681 Opened 22 years ago Closed 22 years ago

Trunk crash [@ nsGfxScrollFrameInner::AddRemoveScrollbar ]

Categories

(Core :: Layout, defect, P2)

Product:
Core
Component:
Layout
Platform:
x86
Linux
Type:
defect

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: spam, Assigned: roc)

References

(
URL
)

Details

(Keywords: crash, regression, topcrash-, Whiteboard: [fix])

Crash Data

Attachments

(2 files, 1 obsolete file)

low-risk fix
913 bytes, patch
Details | Diff | Splinter Review
revised
27.92 KB, patch
dbaron
: review+
dbaron
: superreview+
asa
: approval1.4+
Details | Diff | Splinter Review
Attempting to load http://www.sol.no/tv/guiden/ now crashes. This is a regression. It worked a few weeks ago. Affects current trunk CVS and also latest official nightly, Linux. Talkbacks: TB 19311871Y and a few more #0 0x409d7574 in nsGfxScrollFrameInner::AddRemoveScrollbar(nsBoxLayoutState&, nsRect&, int, int, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #1 0x409d740e in nsGfxScrollFrameInner::AddVerticalScrollbar(nsBoxLayoutState&, nsRect&, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #2 0x409d842b in nsGfxScrollFrameInner::Layout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #3 0x409d76d5 in nsGfxScrollFrame::DoLayout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #4 0x40a96f30 in nsBox::Layout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #5 0x40a99ea3 in nsBoxFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #6 0x409d6ac7 in nsGfxScrollFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #7 0x40a3f708 in nsListControlFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #8 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #9 0x40a26c85 in nsComboboxControlFrame::ReflowComboChildFrame(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&, int, int)---Type <return> to continue, or q <return> to quit--- () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #10 0x40a27b3c in nsComboboxControlFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #11 0x409ecd7b in nsLineLayout::ReflowFrame(nsIFrame*, unsigned&, nsHTMLReflowMetrics*, int&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #12 0x409e929d in nsInlineFrame::ReflowInlineFrame(nsIPresContext*, nsHTMLReflowState const&, nsInlineFrame::InlineReflowState&, nsIFrame*, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #13 0x409e8eef in nsInlineFrame::ReflowFrames(nsIPresContext*, nsHTMLReflowState const&, nsInlineFrame::InlineReflowState&, nsHTMLReflowMetrics&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #14 0x409e8d3c in nsInlineFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #15 0x409ecd7b in nsLineLayout::ReflowFrame(nsIFrame*, unsigned&, nsHTMLReflowMetrics*, int&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #16 0x409bd469 in nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, unsigned char*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #17 0x409bd1ee in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, int*, unsigned char*, int, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #18 0x409bcffe in nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState&, ns---Type <return> to continue, or q <return> to quit--- LineList_iterator, int*, unsigned char*, int, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #19 0x409bced3 in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, int*, int, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #20 0x409bb675 in nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #21 0x409bb447 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #22 0x409b97f7 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #23 0x409c16e3 in nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #24 0x409bc845 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, int*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #25 0x409bb8d3 in nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #26 0x409bb447 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #27 0x409b97f7 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () ---Type <return> to continue, or q <return> to quit--- from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #28 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #29 0x40a755e9 in nsTableCellFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #30 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #31 0x40a8d91b in nsTableRowFrame::ReflowChildren(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, nsTableFrame&, unsigned&, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #32 0x40a8e5d9 in nsTableRowFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #33 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #34 0x40a8f753 in nsTableRowGroupFrame::ReflowChildren(nsIPresContext*, nsHTMLReflowMetrics&, nsRowGroupReflowState&, unsigned&, nsTableRowFrame*, int, nsTableRowFrame**, int*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #35 0x40a91702 in nsTableRowGroupFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so ---Type <return> to continue, or q <return> to quit--- #36 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #37 0x40a7dfd5 in nsTableFrame::ReflowChildren(nsIPresContext*, nsTableReflowState&, int, int, unsigned&, nsIFrame*&, int*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #38 0x40a7baad in nsTableFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #39 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #40 0x40a894aa in nsTableOuterFrame::OuterReflowChild(nsIPresContext*, nsIFrame*, nsHTMLReflowState const&, nsHTMLReflowMetrics&, int, nsSize&, nsMargin&, nsMargin&, nsMargin&, nsReflowReason, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #41 0x40a8b30c in nsTableOuterFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #42 0x409c16e3 in nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #43 0x409bc845 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, int*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #44 0x409bb8d3 in nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_itera---Type <return> to continue, or q <return> to quit--- tor, int*, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #45 0x409bb447 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #46 0x409b97f7 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #47 0x409c16e3 in nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #48 0x409bc845 in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, int*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #49 0x409bb8d3 in nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #50 0x409bb447 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #51 0x409b97f7 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #52 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #53 0x409dafde in CanvasFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () ---Type <return> to continue, or q <return> to quit--- from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #54 0x40a9ea2b in nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState&, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&, int, int, int, int, int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #55 0x40a9e69e in nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #56 0x40a96f30 in nsBox::Layout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #57 0x40a93795 in nsScrollBoxFrame::DoLayout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #58 0x40a96f30 in nsBox::Layout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #59 0x40aa01d1 in nsContainerBox::LayoutChildAt(nsBoxLayoutState&, nsIBox*, nsRect const&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #60 0x409d7691 in nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState&, nsIBox*, nsRect const&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #61 0x409d793c in nsGfxScrollFrameInner::Layout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #62 0x409d76d5 in nsGfxScrollFrame::DoLayout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #63 0x40a96f30 in nsBox::Layout(nsBoxLayoutState&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #64 0x40a99ea3 in nsBoxFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () ---Type <return> to continue, or q <return> to quit--- from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #65 0x409d6ac7 in nsGfxScrollFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #66 0x409c7dc7 in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #67 0x40a1d789 in ViewportFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #68 0x409fe4e3 in IncrementalReflow::Dispatch(nsIPresContext*, nsHTMLReflowMetrics&, nsSize const&, nsIRenderingContext&) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #69 0x40a0a726 in PresShell::ProcessReflowCommands(int) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #70 0x40a0bf59 in ReflowEvent::HandleEvent() () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #71 0x40a0a32b in HandlePLEvent(ReflowEvent*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libgklayout.so #72 0x407999cb in PL_HandleEvent () from /home/dark/MOZ/TREE1/mozilla/dist/bin/libxpcom.so #73 0x407998e5 in PL_ProcessPendingEvents () from /home/dark/MOZ/TREE1/mozilla/dist/bin/libxpcom.so #74 0x4079aa13 in nsEventQueueImpl::ProcessPendingEvents() () from /home/dark/MOZ/TREE1/mozilla/dist/bin/libxpcom.so #75 0x40e6a886 in event_processor_callback(void*, int, GdkInputCondition) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libwidget_gtk.so #76 0x40e6a4b4 in our_gdk_io_invoke(_GIOChannel*, GIOCondition, void*) () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libwidget_gtk.so #77 0x402af076 in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0 #78 0x402b097e in g_main_dispatch () from /usr/lib/libglib-1.2.so.0 #79 0x402b0e59 in g_main_iterate () from /usr/lib/libglib-1.2.so.0 #80 0x402b10f4 in g_main_run () from /usr/lib/libglib-1.2.so.0 #81 0x401af6df in gtk_main () from /usr/lib/libgtk-1.2.so.0 #82 0x40e6ac18 in nsAppShell::Run() () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libwidget_gtk.so #83 0x40e4da7a in nsAppShellService::Run() () from /home/dark/MOZ/TREE1/mozilla/dist/bin/components/libnsappshell.so #84 0x08058804 in main1(int, char**, nsISupports*) () #85 0x08058f30 in main () #86 0x420159b4 in __libc_start_main () from /lib/i686/libc.so.6 (gdb)
it's so me
Assignee: other → roc+moz
Priority: -- → P2
Keywords: crash
I get this assertion before crashing on Linux (CVS 20030420): ###!!! ASSERTION: Found multiple vertical scrollbars?: '!mInner->mVScrollbarBox', file nsGfxScrollFrame.cpp, line 487 Break: at file nsGfxScrollFrame.cpp, line 487
Summary: crash (nsGfxScrollFrameInner::AddRemoveScrollbar → crash [@ nsGfxScrollFrameInner::AddRemoveScrollbar ]
I can confirm a crash at the above site, both using a build from last week and using the latest nightly build (2003-04-21-05) running on Windows 2000 SP3. I did not dig very deep into the crash (as tools and time are limited), but it does seem to occur at the point in rendering the page where toolbars should appear. At the very least this is now confirmation on another OS and probably cause for changing to PC:All, if not All:All.
Adding topcrash keyword, this is a current topcrasher on the MozillaTrunk. Here is the latest from Talkback: nsGfxScrollFrameInner::AddRemoveScrollbar 7 124421 VERI WORK attinasi@netscape.com Future 2002-04-16 BBID range: 19286360 - 19334181 Min/Max Seconds since last crash: 11 - 3063 Min/Max Runtime: 58 - 57144 Crash data range: 2003-04-18 to 2003-04-20 Build ID range: 2003041508 to 2003041908 Stack Trace: nsGfxScrollFrameInner::AddRemoveScrollbar() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 1158] nsGfxScrollFrameInner::AddVerticalScrollbar() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 1111] nsGfxScrollFrameInner::Layout() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 1385] nsGfxScrollFrame::DoLayout() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 1213] nsBox::Layout() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp line 1073] nsBoxFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp line 902] nsGfxScrollFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 836] nsListControlFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/forms/src/nsListControlFrame.cpp line 1382] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] nsComboboxControlFrame::ReflowComboChildFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp line 692] nsComboboxControlFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp line 328] nsLineLayout::ReflowFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsLineLayout.cpp line 1034] nsInlineFrame::ReflowInlineFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp line 736] nsInlineFrame::ReflowFrames() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp line 549] nsInlineFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsInlineFrame.cpp line 458] nsLineLayout::ReflowFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsLineLayout.cpp line 1034] nsBlockFrame::ReflowInlineFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 3867] nsBlockFrame::DoReflowInlineFrames() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 3735] nsBlockFrame::DoReflowInlineFramesAuto() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 3635] nsBlockFrame::ReflowInlineFrames() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 3581] nsBlockFrame::ReflowLine() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2679] nsBlockFrame::ReflowDirtyLines() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2325] nsBlockFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 944] nsBlockReflowContext::ReflowBlock() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp line 546] nsBlockFrame::ReflowBlockFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 3346] nsBlockFrame::ReflowLine() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2543] nsBlockFrame::ReflowDirtyLines() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2325] nsBlockFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 944] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] nsTableCellFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableCellFrame.cpp line 448] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] nsTableRowFrame::ReflowChildren() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowFrame.cpp line 1053] nsTableRowFrame::IR_TargetIsMe() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowFrame.cpp line 1221] nsTableRowFrame::IncrementalReflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowFrame.cpp line 1195] nsTableRowFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowFrame.cpp line 1470] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] nsTableRowGroupFrame::IR_TargetIsChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp line 1744] nsTableRowGroupFrame::IncrementalReflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp line 1414] nsTableRowGroupFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp line 1323] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] nsTableFrame::IR_TargetIsChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableFrame.cpp line 3036] nsTableFrame::IncrementalReflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableFrame.cpp line 2764] nsTableFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableFrame.cpp line 2021] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] nsTableOuterFrame::OuterReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp line 1341] nsTableOuterFrame::IR_InnerTableReflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp line 1738] nsTableOuterFrame::IR_TargetIsInnerTableFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp line 1501] nsTableOuterFrame::IR_TargetIsChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp line 1484] nsTableOuterFrame::IncrementalReflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp line 1452] nsTableOuterFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp line 1984] nsBlockReflowContext::ReflowBlock() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp line 546] nsBlockFrame::ReflowBlockFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 3346] nsBlockFrame::ReflowLine() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2543] nsBlockFrame::ReflowDirtyLines() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2325] nsBlockFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 944] nsBlockReflowContext::ReflowBlock() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp line 546] nsBlockFrame::ReflowBlockFrame() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 3346] nsBlockFrame::ReflowLine() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2543] nsBlockFrame::ReflowDirtyLines() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 2325] nsBlockFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp line 944] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] CanvasFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsHTMLFrame.cpp line 589] nsBoxToBlockAdaptor::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp line 904] nsBoxToBlockAdaptor::DoLayout() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp line 645] nsBox::Layout() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp line 1073] nsScrollBoxFrame::DoLayout() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp line 360] nsBox::Layout() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp line 1073] nsContainerBox::LayoutChildAt() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsContainerBox.cpp line 650] nsGfxScrollFrameInner::LayoutBox() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 1205] nsGfxScrollFrameInner::Layout() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 1360] nsGfxScrollFrame::DoLayout() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 1213] nsBox::Layout() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp line 1073] nsBoxFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp line 902] nsGfxScrollFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line 836] nsContainerFrame::ReflowChild() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp line 958] ViewportFrame::Reflow() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp line 262] IncrementalReflow::Dispatch() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp line 672] PresShell::ProcessReflowCommands() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp line 6607] HandlePLEvent() [/builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp line 590] PL_HandleEvent() [/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c line 659] PL_ProcessPendingEvents() [/builds/client/linux22/seamonkey/mozilla/xpcom/threads/plevent.c line 594] nsEventQueueImpl::ProcessPendingEvents() [/builds/client/linux22/seamonkey/mozilla/xpcom/threads/nsEventQueue.cpp line 391] event_processor_callback() [/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp line 194] our_gdk_io_invoke() [/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp line 75] libglib-1.2.so.0 + 0xee10 (0x4024de10) libglib-1.2.so.0 + 0x104d8 (0x4024f4d8) libglib-1.2.so.0 + 0x10ae3 (0x4024fae3) libglib-1.2.so.0 + 0x10c7c (0x4024fc7c) libgtk-1.2.so.0 + 0x8d7e7 (0x401707e7) nsAppShell::Run() [/builds/client/linux22/seamonkey/mozilla/widget/src/gtk/nsAppShell.cpp line 336] nsAppShellService::Run() [/builds/client/linux22/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp line 478] main1() [/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp line 1666] main() [/builds/client/linux22/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp line 1650] libc.so.6 + 0x1914f (0x4038c14f) Source File : /builds/client/linux22/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp line : 1158 (19334181) Comments: testing Bug 202681. (Indeed it crashes.) (19317722) URL: http://www.sol.no/tv/guiden/ (19312066) URL: http://www.sol.no/tv/guiden/ (19312052) URL: http://www.sol.no/tv/guiden/ (19311871) URL: http://www.sol.no/tv/guiden/ (19311871) Comments: mozilla has suddenly started to crash when trying to load that page (19286360) URL: www.wheresgeorge.com
Keywords: topcrash
Summary: crash [@ nsGfxScrollFrameInner::AddRemoveScrollbar ] → Trunk crash [@ nsGfxScrollFrameInner::AddRemoveScrollbar ]
We're reflowing a deleted scrollframe, but I can't get this to reproduce under valgrind.
I could reproduce this before, but now I can't after pulling and building yesterday. Can anyone still reproduce this with today's build?
2003042915 linux-sea.tar.gz crashes
official trunk 2003042922 crashes too. Now talkback doesn't trigger again but it seems talkback is only sporadically included in the linux builds anyway.
I finally tracked this down, and it's a doozy. Basically this is what happens: -- a <select> is reflowed, and nsGfxScrollFrame::AddRemoveScrollbar adds a scrollbar -- nsGfxScrollFrame "lazy scrollbars" twiddles attributes on the <scrollbar>; the -moz-binding property change triggers frame creation for the scrollbar -- XBL binding attachment causes the parser to flush content notifications first -- the new content adds a block element to the line containing the <select> which is being reflowed -- This triggers nsCSSFrameConstructor::WipeContainingBlock to recreate the block containing the <select> so the inlines and blocks can be separated -- This causes the existing <select> frame (and its nsGfxScrollFrame) to be Destroy()ed and a new one to be created -- We proceed to unwind this huge stack until we arrive back at nsGfxScrollFrame::AddRemoveScrollbar, which is now operating on a frame which has been deleted -- BOOM I wonder what we should do to avoid this... Never set attributes (issuing style change notifications) during Reflow?
Only 1 crash from a build in may reported in talkback. Not showing up on talkback reports for any products. Marking topcrash-
Keywords: topcrash → topcrash-
Yes the crash still happens in May builds. I just crashed with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/2003050708, but the talkback did not start. (Either the talkback is not included, or for some reason it is not triggered any more.)
OK, here's how I plan to fix this. I'll remove the -moz-binding:none for lazy='true' scrollbars. I'll partially recover the performance by having nsListControlFrame not create an anonymous horizontal scrollbar element (completely disabling horizontal scrollbars for listboxes and comboboxes).
Attached patch full fix (obsolete) — — Splinter Review
Here's the full patch. It removes the lazy optimization and instead refrains from creating anonymous content for scrollbars which will not be used according to the 'overflow' property. I've refactored the scrollbar enablement styling to support independent styling of the horizontal and vertical scrollbars internally (a la IE's 'overflow-x', 'overflow-y' properties). We don't support this in the style system yet so for now the seperate styles are derived from the single 'overflow' property. nsListControlFrame hardcodes its style settings in C++ because its desired styles cannot be expressed in our style system yet. This patch is somewhat risky, I suppose.
Attached patch low-risk fix — — Splinter Review
Here's the low-risk fix which just disables the lazy optimization. This patch will probably negatively impact Tp. The above patch should have less Tp impact because it introduces a new similar optimization.
Been running with the first patch all day - since you added it - and i can't find any new weirdness or anything striking. Except that the page again loads without crashing, that is. Far as I can judge as a user, the "full fix" is good as gold.
Comment on attachment 123616 [details] [diff] [review] full fix Note that this patch is also organized in a way that would make transition to separate 'overflow-x', 'overflow-y' properties fairly painless once style system support was added. (although that would require changes elsewhere, such as in nsCSSFrameConstructor).
Attachment #123616 - Flags: superreview?(dbaron)
Attachment #123616 - Flags: review?(dbaron)
Comment on attachment 123616 [details] [diff] [review] full fix In nsGfxScrollFrame::GetPrefSize and nsGfxScrollFrame::GetMinSize these two lines: > nsIFrame* frame = nsnull; > GetFrame(&frame); aren't needed anymore.
Comment on attachment 123616 [details] [diff] [review] full fix >- PRBool isSmooth = vcontent->HasAttr(kNameSpaceID_None, nsXULAtoms::smooth) >- || hcontent->HasAttr(kNameSpaceID_None, nsXULAtoms::smooth); >+ PRBool isSmooth = targetContent->HasAttr(kNameSpaceID_None, nsXULAtoms::smooth); targetContent doesn't look like it's guaranteed to be non-null. Do you need a null-check, or some reorganization, perhaps? Other than that (and my previous comment), r+sr=dbaron.
Attachment #123616 - Flags: superreview?(dbaron)
Attachment #123616 - Flags: superreview+
Attachment #123616 - Flags: review?(dbaron)
Attachment #123616 - Flags: review+
targetContent is in fact guaranteed to be non-null by this code, but I just realized that the targetcontent and targetframe setting is totally bogus and has been for a long time. I will rev the patch.
Attached patch revised — — Splinter Review
targetcontent should just be aContent, so get rid of it.
Attachment #123616 - Attachment is obsolete: true
Comment on attachment 123717 [details] [diff] [review] revised Sorry David, the only changes here are in the AttributeChanged function (oh, plus the removal of GetFrame that you mentioned)
Attachment #123717 - Flags: superreview?(dbaron)
Attachment #123717 - Flags: review?(dbaron)
Attachment #123717 - Flags: superreview?(dbaron)
Attachment #123717 - Flags: superreview+
Attachment #123717 - Flags: review?(dbaron)
Attachment #123717 - Flags: review+
Comment on attachment 123717 [details] [diff] [review] revised >- nsIFrame * targetFrame = nsnull; >- nsCOMPtr<nsIContent> targetContent; >- if (hcontent.get() == aContent || vcontent.get() == aContent) >+ if (hcontent.get() == aContent || vcontent.get() == aContent) ...but if you're modifying this line anyway, could you remove the |.get()|s?
oh yeah. Sure. I'll also fix the indenting just before I check in.
Comment on attachment 123717 [details] [diff] [review] revised OK, this is a questionable one for approval. The good news is that the fix is fairly well understood. The bad news is that it's quite nontrivial and affects very core code. The other good news is that R.K.Aa has been surfing with this patch for a while without noticing any regressions. This patch will affect Tp but we don't know how, that could be bad news or good news. But it's got to be better for Tp than the "safe" fix and one of these two must go in. If this doesn't get approved then at least let's approve the other, safe, patch, even though I'm pretty sure it will hurt Tp.
Attachment #123717 - Flags: approval1.4?
Still surfing, and all is well.
Comment on attachment 123717 [details] [diff] [review] revised a=asa (on behalf of drivers) for checkin to 1.4
Attachment #123717 - Flags: approval1.4? → approval1.4+
Checked in!
Status: NEW → RESOLVED
Closed: 22 years ago
Resolution: --- → FIXED
This checkin had no apparent Tp impact. yay! Txul on luna (Linux) went up by about 2%. But Txul went down by about 7% on comet (Linux), and down by about 20% on monkey (Mac OSX). I think over all the patches, the switch to Gfx scrollbars for form controls plus optimizations cost us about 3% on Tp and improved Txul by some variable amount.
Crash Signature: [@ nsGfxScrollFrameInner::AddRemoveScrollbar ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: