210261 - setting html{overflow:scroll} 3 times crashes [@ nsViewManager::UpdateView ]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Go to mozilla.org (or just about any other web site).
2. Use the "edit styles" bookmarklet (from
http://www.squarefree.com/bookmarklets/webdevel.html).
3. Add "html { overflow: scroll }".  (Leave out the closing } if it is not
necesssary in the version of Gecko you're using.)

Result: An extra vertical scrollbar appears.  Good so far.

4. Add a space.

Result: Weird stuff happens. For example, a scrollbar appears at the left of the
page, or the arrow on the top of a vertical scrollbar suddenly points left.  At
this point, Firebird is more or less doomed to crash.

Expected: adding a space to the end of a stylesheet shouldn't change anything.

5. Add another space.

Result: Firebird crashes (talkback ids: TB21249929X with 05/22, TB21250048H with
06/21) or enters a state where closing all windows does not exit.

Comment 1

[Hermann Schwab]

TB21257172K on Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.5a) Gecko/20030620

Comment 2

[Adam Hauner]

Stack trace(Frame) 

	 nsViewManager::UpdateView
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 1739] 
	 nsViewManager::MoveViewTo
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp  line 2580] 
	 nsContainerFrame::PositionFrameView
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp  line 496] 
	 nsContainerFrame::SyncFrameViewAfterReflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp  line 707] 
	 nsLineLayout::RelativePositionFrames
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsLineLayout.cpp  line 3095] 
	 nsLineLayout::RelativePositionFrames
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsLineLayout.cpp  line 3037] 
	 nsBlockFrame::PlaceLine
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 4145] 
	 nsBlockFrame::DoReflowInlineFrames
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 3658] 
	 nsBlockFrame::DoReflowInlineFramesAuto
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 3475] 
	 nsBlockFrame::ReflowInlineFrames
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 3420] 
	 nsBlockFrame::ReflowLine
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 2505] 
	 nsBlockFrame::ReflowDirtyLines
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 2181] 
	 nsBlockFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 860] 
	 nsBlockReflowContext::ReflowBlock
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockReflowContext.cpp  line
519] 
	 nsBlockFrame::ReflowBlockFrame
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 3191] 
	 nsBlockFrame::ReflowLine
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 2402] 
	 nsBlockFrame::ReflowDirtyLines
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 2181] 
	 nsBlockFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsBlockFrame.cpp  line 860] 
	 nsBoxToBlockAdaptor::Reflow
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp  line 892] 
	 nsBoxToBlockAdaptor::RefreshSizeCache
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp  line 393] 
	 nsBoxToBlockAdaptor::GetPrefSize
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp  line 491] 
	 nsScrollBoxFrame::GetPrefSize
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp  line 544] 
	 nsGfxScrollFrame::GetPrefSize
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp  line 733] 
	 nsBoxFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp  line 843] 
	 nsGfxScrollFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp  line 836] 
	 nsContainerFrame::ReflowChild
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp  line 940] 
	 CanvasFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsHTMLFrame.cpp  line 570] 
	 nsBoxToBlockAdaptor::Reflow
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp  line 892] 
	 nsBoxToBlockAdaptor::DoLayout
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp  line 636] 
	 nsBox::Layout	[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp  line
1000] 
	 nsScrollBoxFrame::DoLayout
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsScrollBoxFrame.cpp  line 339] 
	 nsBox::Layout	[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp  line
1000] 
	 nsContainerBox::LayoutChildAt
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsContainerBox.cpp  line 654] 
	 nsGfxScrollFrameInner::LayoutBox
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp  line 1197] 
	 nsGfxScrollFrameInner::Layout
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp  line 1350] 
	 nsGfxScrollFrame::DoLayout
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp  line 1205] 
	 nsBox::Layout	[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBox.cpp  line
1000] 
	 nsBoxFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/xul/base/src/nsBoxFrame.cpp  line 883] 
	 nsGfxScrollFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp  line 836] 
	 nsContainerFrame::ReflowChild
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsContainerFrame.cpp  line 940] 
	 ViewportFrame::Reflow
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsViewportFrame.cpp  line 263] 
	 IncrementalReflow::Dispatch
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 918] 
	 PresShell::ProcessReflowCommands
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6488] 
	 ReflowEvent::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp  line 6334] 
	 PL_HandleEvent	[c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c  line 672] 
	 PL_ProcessPendingEvents	[c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c 
line 610] 
	 nsEventQueueImpl::ProcessPendingEvents
[c:/builds/seamonkey/mozilla/xpcom/threads/nsEventQueue.cpp  line 395] 
	 0x18a16457

Bug 107518 and bug 151826 have same crash signature, stacktraces are different.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

probably mine

Comment 4

[Boris Zbarsky [:bzbarsky]]

*** Bug 234851 has been marked as a duplicate of this bug. ***

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This should have been fixed by the checkin for bug 234851.