[CRASH] Crash at clicking pull down menu in this page

VERIFIED WORKSFORME

Status

()

Core
Layout
P3
critical
VERIFIED WORKSFORME
19 years ago
19 years ago

People

(Reporter: Teruko Kobayashi, Assigned: joki (gone))

Tracking

Trunk
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: can't reproduce? teruko, do you still see this?, URL)

(Reporter)

Description

19 years ago
Mozilla.exe will crash when you click on the second pull down menu of this page.

Steps of reproduce
1. Go to above URL
2. Click on second pull down menu which starts 'NTT' word
Mozilla.exe will crash.
If you click on other pull down menus in the page, Mozilla.exe does not crash.

This happens 120108 Win32, Mac, and Linux build.

Stack trace Incident 1665441
 Trigger Type:  Program Crash

 Trigger Reason:  Access violation

 Call Stack:    (Signature = PlaceFrameView 8bddbc36)

   PlaceFrameView
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2820]
   nsBlockFrame::PostPlaceLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4194]
   nsBlockFrame::PlaceLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 4067]
   nsBlockFrame::DoReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3651]
   nsBlockFrame::DoReflowInlineFramesAuto
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3523]
   nsBlockFrame::ReflowInlineFrames
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3472]
   nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2679]
   nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2436]
   nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1491]
   nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
260]
   nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3259]
   nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2629]
   nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2436]
   nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1491]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   nsTableCellFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableCellFrame.cpp, line
669]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   nsTableRowFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line
1313]
   nsTableRowFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line
1192]
   nsTableRowFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowFrame.cpp, line
1464]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   nsTableRowGroupFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1519]
   nsTableRowGroupFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1126]
   nsTableRowGroupFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableRowGroupFrame.cpp,
line 1032]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   nsTableFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2369]
   nsTableFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 2184]
   nsTableFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 1236]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   nsTableOuterFrame::IR_InnerTableReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line
589]

nsTableOuterFrame::IR_TargetIsInnerTableFrame[d:\builds\seamonkey\mozilla\layout
\html\table\src\nsTableOuterFrame.cpp, line 379]
   nsTableOuterFrame::IR_TargetIsChild
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line
370]
   nsTableOuterFrame::IncrementalReflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line
337]
   nsTableOuterFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line
865]
   nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
260]
   nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3259]
   nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2629]
   nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2436]
   nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1491]
   nsBlockReflowContext::ReflowBlock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockReflowContext.cpp, line
260]
   nsBlockFrame::ReflowBlockFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 3259]
   nsBlockFrame::ReflowLine
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2629]
   nsBlockFrame::ReflowDirtyLines
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 2436]
   nsBlockFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1491]
   nsAreaFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsAreaFrame.cpp, line 294]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   RootFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLFrame.cpp, line 336]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   nsScrollPortFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsScrollPortFrame.cpp, line
422]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   nsGfxScrollFrameInner::ReflowFrame
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line
1214]
   nsGfxScrollFrameInner::ReflowScrollArea
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line
1279]
   nsGfxScrollFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsGfxScrollFrame.cpp, line
471]
   nsContainerFrame::ReflowChild
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line
628]
   ViewportFrame::Reflow
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 527]
   nsHTMLReflowCommand::Dispatch
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLReflowCommand.cpp, line
145]
   PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1650]
   PresShell::ExitReflowLock
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 709]
   PresShell::ContentStatesChanged
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2058]
   nsDocument::ContentStatesChanged
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1532]
   nsEventStateManager::SetContentState
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line
1867]
   nsEventStateManager::GenerateMouseEnterExit
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line
1082]
   nsEventStateManager::PreHandleEvent
[d:\builds\seamonkey\mozilla\layout\events\src\nsEventStateManager.cpp, line
191]
   PresShell::HandleEvent

Updated

19 years ago
Severity: major → critical

Updated

19 years ago
Assignee: troy → joki

Comment 1

19 years ago
I crash in event handling code. It seems that mMouseListener points to invalid
memory

nsEventListenerManager::HandleEvent(nsIPresContext * 0x01ce2528, nsEvent *
0x0012fbf0, nsIDOMEvent * * 0x0012f8d8, unsigned int 2, nsEventStatus *
0x0012fafc) line 704 + 9 bytes
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x01ce2528, nsEvent *
0x0012fbf0, nsIDOMEvent * * 0x0012f8d8, unsigned int 2, nsEventStatus *
0x0012fafc) line 795
nsHTMLSelectElement::HandleDOMEvent(nsHTMLSelectElement * const 0x01f64070,
nsIPresContext * 0x01ce2528, nsEvent * 0x0012fbf0, nsIDOMEvent * * 0x0012f8d8,
unsigned int 2, nsEventStatus * 0x0012fafc) line 832
nsGenericElement::HandleDOMEvent(nsIPresContext * 0x01ce2528, nsEvent *
0x0012fbf0, nsIDOMEvent * * 0x0012f8d8, unsigned int 1, nsEventStatus *
0x0012fafc) line 797 + 39 bytes
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x020190b4,
nsIPresContext * 0x01ce2528, nsEvent * 0x0012fbf0, nsIDOMEvent * * 0x00000000,
unsigned int 1, nsEventStatus * 0x0012fafc) line 626 + 31 bytes
PresShell::HandleEvent(PresShell * const 0x01e3ddac, nsIView * 0x01d3d900,
nsGUIEvent * 0x0012fbf0, nsEventStatus * 0x0012fafc) line 2444 + 39 bytes
nsView::HandleEvent(nsView * const 0x01d3d900, nsGUIEvent * 0x0012fbf0, unsigned
int 8, nsEventStatus * 0x0012fafc, int & 0) line 841
nsView::HandleEvent(nsView * const 0x01d3d1d0, nsGUIEvent * 0x0012fbf0, unsigned
int 8, nsEventStatus * 0x0012fafc, int & 0) line 826
nsView::HandleEvent(nsView * const 0x01e3d9a0, nsGUIEvent * 0x0012fbf0, unsigned
int 28, nsEventStatus * 0x0012fafc, int & 0) line 826
nsViewManager::DispatchEvent(nsViewManager * const 0x01d58c38, nsGUIEvent *
0x0012fbf0, nsEventStatus * 0x0012fafc) line 1678
HandleEvent(nsGUIEvent * 0x0012fbf0) line 69
nsWindow::DispatchEvent(nsWindow * const 0x01d3d28c, nsGUIEvent * 0x0012fbf0,
nsEventStatus & nsEventStatus_eIgnore) line 437 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbf0) line 458
nsWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line 3464 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 302, nsPoint * 0x00000000) line
3682
nsWindow::ProcessMessage(unsigned int 513, unsigned int 1, long 27263567, long *
0x0012fe5c) line 2752 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00040216, unsigned int 513, unsigned int 1, long
27263567) line 624 + 27 bytes
USER32! 77e135f8()
USER32! 77e13769()
USER32! 77e17b9a()
main(int 1, char * * 0x00a94a30) line 137 + 11 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 2

19 years ago
With the Dec 06th build, I can't reproduce the crash as described.  I would like
to provide a stack trace for this bug but can't.
Summary: Crash at clicking pull down menu in this page → [CRASH] Crash at clicking pull down menu in this page
Whiteboard: can't reproduce? teruko, do you still see this?
(Assignee)

Comment 3

19 years ago
Moving crash bugs into M13.
(Reporter)

Updated

19 years ago
Status: NEW → RESOLVED
Last Resolved: 19 years ago
Resolution: --- → WORKSFORME
(Reporter)

Comment 4

19 years ago
I do not see this problem in 01-03-08 build.

Updated

19 years ago
Status: RESOLVED → VERIFIED

Comment 5

19 years ago
I can't repro this problem in Jan 05 build. Can the reporter check this out with
the latest build ?
You need to log in before you can comment on or make changes to this bug.