238546 - Crash shutting down [@ PresShell::DidDoReflow]

Status: RESOLVED DUPLICATE of bug 234435

(Core :: Layout, defect)

Description

[timeless]

mozilla pre 1.7a w/ changes, but none to layout. we were shutting down

>	gklayout.dll!PresShell::DidDoReflow()  Line 6349 + 0xe	C++
 	gklayout.dll!PresShell::ProcessReflowCommands(int aInterruptible=1)  
Line 6493	C++
 	gklayout.dll!ReflowEvent::HandleEvent()  Line 6256	C++
 	gklayout.dll!HandlePLEvent(ReflowEvent * aEvent=0x03ce8b10)  Line 6270
	C++
 	xpcom.dll!PL_HandleEvent(PLEvent * self=0x03ce8b10)  Line 671 + 0xa
	C
 	xpcom.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x009bb2b0)  Line 
606 + 0x9	C
 	xpcom.dll!_md_EventReceiverProc(HWND__ * hwnd=0x00660290, unsigned int 
uMsg=49702, unsigned int wParam=0, long lParam=10203824)  Line 1412 + 0x9
	C
 	user32.dll!_InternalCallWinProc@20()  + 0x1b	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7	
 	user32.dll!_DispatchMessageWorker@8()  + 0xd8	
 	user32.dll!_DispatchMessageW@4()  + 0xb	
 	gkwidget.dll!nsAppShell::Run()  Line 135	C++
 	appshell.dll!nsAppShellService::Run()  Line 484	C++
 	mozilla.exe!main1(int argc=1, char * * argv=0x002a4df8, nsISupports * 
nativeApp=0x0097af80)  Line 1291 + 0x20	C++
 	mozilla.exe!main(int argc=1, char * * argv=0x002a4df8)  Line 1678 + 0x25
	C++
 	mozilla.exe!WinMain(HINSTANCE__ * __formal=0x00400000, HINSTANCE__ * 
__formal=0x00400000, char * args=0x00152300, HINSTANCE__ * 
__formal=0x00400000)  Line 1702 + 0x17	C++
 	mozilla.exe!WinMainCRTStartup()  Line 390 + 0x1b	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23	

void
PresShell::DidDoReflow()
{
  HandlePostedDOMEvents();
  HandlePostedAttributeChanges();
  HandlePostedReflowCallbacks();
  if (!mPaintingSuppressed)
    mViewManager->SynthesizeMouseMove(PR_FALSE); // crashed
}

+	mViewManager	0x00000000	nsIViewManager *

I have a proposal

Comment 1

[timeless]

Attachment: try to suppress painting when the viewmanager goes away

Comment 2

[timeless]

Comment on attachment 144681 [details] [diff] [review]
try to suppress painting when the viewmanager goes away

sorry about the tabs, i'm using a coworker's box and his non default editor
wasn't tamed.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 144681 [details] [diff] [review]
try to suppress painting when the viewmanager goes away

It's much clearer to null-check mViewManager at the crash site, which doesn't
exist anymore, with a comment about happening during Destroy.  However, this
stack shouldn't be possible -- like some of the other crashes related to bug
20022, it seems like revoking events didn't actually revoke the events.

This crash stack can't happen anymore, but adding as a bug 20022 dependency for
when that is relanded.

Any useful steps to reproduce?

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I relanded bug 

*** This bug has been marked as a duplicate of 234435 ***

Comment 5

[timeless]

sorry, no steps, all i know is what i wrote in the bug which was that we were
quiting. is there a cvs checkin i can peel off into our tree, or was this fixed
by some large patch? we're shipping based on a 1.7bish thing... (which replaced
the 1.7aish thing of this report)