Closed Bug 241068 Opened 18 years ago Closed 18 years ago

Crash when trying to enter text in input field. [@ nsTreeBodyFrame::PrefillPropertyArray][@ _ZN15nsTreeBodyFrame20PrefillPropertyArrayEiP12nsTreeColumn]

Categories

(Firefox :: Address Bar, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: fredrik.henrysson, Assigned: janv)

References

()

Details

(Keywords: crash, regression, topcrash, Whiteboard: DO NOT SET ANY BLOCKING0.9 OR BLOCKING 1.0 FLAGS!)

Crash Data

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a) Gecko/20040419 Firefox/0.8.0+
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a) Gecko/20040419 Firefox/0.8.0+

When the auto complete box showing older entries should show up the browser
crashes. Stack trace attached. 

Reproducible: Always
Steps to Reproduce:
1. Go to http://www.a9.com
2. Start enter text.
3. Watch the list of older entered item popup.

Actual Results:  
Crash.

Expected Results:  
List showing old entries and not crash.

Date/Time:      2004-04-20 10:11:58 +0200
OS Version:     10.3.3 (Build 7F44)
Report Version: 2

Command: firefox-bin
Path:    /Volumes/Firefox/Firefox.app/Contents/MacOS/firefox-bin
Version: 0.8.0+ (0.8.0+)
PID:     1017
Thread:  0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   org.mozilla.firefox 	0x0045305c nsTreeBodyFrame::PrefillPropertyArray(int,
nsTreeColumn*) + 0x584
1   org.mozilla.firefox 	0x004549e0 nsTreeBodyFrame::PaintColumn(nsTreeColumn*,
nsRect const&, nsIPresContext*, nsIRenderingContext&, nsRect const&) + 0x34
2   org.mozilla.firefox 	0x00454704 nsTreeBodyFrame::Paint(nsIPresContext*,
nsIRenderingContext&, nsRect const&, nsFramePaintLayer, unsigned) + 0x220
3   org.mozilla.firefox 	0x001f95d8 PresShell::Paint(nsIView*,
nsIRenderingContext&, nsRect const&) + 0xe0
4   org.mozilla.firefox 	0x0032fb0c nsView::Paint(nsIRenderingContext&, nsRect
const&, unsigned, int&) + 0x80
5   org.mozilla.firefox 	0x002bc0b0
nsViewManager::RenderDisplayListElement(DisplayListElement2*,
nsIRenderingContext*) + 0x100
6   org.mozilla.firefox 	0x002bb9b4 nsViewManager::RenderViews(nsView*,
nsIRenderingContext&, nsRegion const&, void*, nsVoidArray const&) + 0x1ec
7   org.mozilla.firefox 	0x002ba6cc nsViewManager::Refresh(nsView*,
nsIRenderingContext*, nsIRegion*, unsigned) + 0x50c
8   org.mozilla.firefox 	0x002bd080 nsViewManager::DispatchEvent(nsGUIEvent*,
nsEventStatus*) + 0x304
9   org.mozilla.firefox 	0x0032f5b4 nsBox::QueryInterface(nsID const&, void**) +
0x134
10  org.mozilla.firefox 	0x001cf704 nsWindow::DispatchEvent(nsGUIEvent*,
nsEventStatus&) + 0xac
11  org.mozilla.firefox 	0x001cf7cc nsWindow::DispatchWindowEvent(nsGUIEvent&,
nsEventStatus&) + 0x24
12  org.mozilla.firefox 	0x001cf27c nsWindow::UpdateWidget(nsRect&,
nsIRenderingContext*) + 0xd4
13  org.mozilla.firefox 	0x001ceaa8 nsWindow::PaintUpdateRectProc(unsigned
short, OpaqueRgnHandle*, Rect const*, void*) + 0xf0
14  org.mozilla.firefox 	0x001ceea8
nsWindow::HandleUpdateEvent(OpaqueRgnHandle*) + 0x244
15  org.mozilla.firefox 	0x001cb390 nsMacEventHandler::UpdateEvent() + 0x24
16  org.mozilla.firefox 	0x001c9da0
nsMacEventHandler::HandleOSEvent(EventRecord&) + 0xac
17  org.mozilla.firefox 	0x001b1da8 nsMacWindow::DispatchEvent(void*, int*) + 0x38
18  org.mozilla.firefox 	0x001c500c
nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, OpaqueWindowPtr*) + 0x60
19  org.mozilla.firefox 	0x001c445c nsMacMessagePump::DoUpdate(EventRecord&) + 0x94
20  org.mozilla.firefox 	0x001c4304 nsMacMessagePump::DispatchEvent(int,
EventRecord*) + 0xd4
21  org.mozilla.firefox 	0x001c4100 nsMacMessagePump::DoMessagePump() + 0x40
22  org.mozilla.firefox 	0x001ab4c0 nsAppShell::Run() + 0x38
23  org.mozilla.firefox 	0x007df3e8 getCountry(nsAString const&, nsAString&) +
0x15d0
24  org.mozilla.firefox 	0x007dfb3c xre_main(int, char**, nsXREAppData const&) +
0x2cc
25  org.mozilla.firefox 	0x00004af0 main + 0xa0
26  org.mozilla.firefox 	0x00004780 start + 0x1b0
27  org.mozilla.firefox 	0x00004600 start + 0x30

Thread 1:
0   libSystem.B.dylib   	0x9000b30c select + 0xc
1   libnspr4.dylib      	0x00da2a3c poll + 0x188
2   libnspr4.dylib      	0x00d9f288 PR_OpenDir + 0x3b0
3   org.mozilla.firefox 	0x000ad0d0 nsSocketTransportService::Run() + 0x198
4   libxpcom.dylib      	0x05043dd4 nsThread::Main(void*) + 0x38
5   libnspr4.dylib      	0x00da06d0 PR_Select + 0x33c
6   libSystem.B.dylib   	0x900247e8 _pthread_body + 0x28

Thread 2:
0   libSystem.B.dylib   	0x900075c8 mach_msg_trap + 0x8
1   libSystem.B.dylib   	0x90007118 mach_msg + 0x38
2   com.unsanity.ape    	0xc000a954 __ape_internal + 0x90b8
3   com.unsanity.ape    	0xc0001328 __ape_agent + 0x40
4   libSystem.B.dylib   	0x900247e8 _pthread_body + 0x28

Thread 3:
0   libSystem.B.dylib   	0x90018ce8 semaphore_timedwait_signal_trap + 0x8
1   libSystem.B.dylib   	0x9000e888 _pthread_cond_wait + 0x268
2   libnspr4.dylib      	0x00d9b5e8 PR_Unlock + 0x12c
3   libnspr4.dylib      	0x00d9b84c PR_WaitCondVar + 0x88
4   libxpcom.dylib      	0x05046890 TimerThread::Run() + 0x1ac
5   libxpcom.dylib      	0x05043dd4 nsThread::Main(void*) + 0x38
6   libnspr4.dylib      	0x00da06d0 PR_Select + 0x33c
7   libSystem.B.dylib   	0x900247e8 _pthread_body + 0x28

Thread 4:
0   libSystem.B.dylib   	0x90018ce8 semaphore_timedwait_signal_trap + 0x8
1   libSystem.B.dylib   	0x9000e888 _pthread_cond_wait + 0x268
2   libnspr4.dylib      	0x00d9b5e8 PR_Unlock + 0x12c
3   libnspr4.dylib      	0x00d9b84c PR_WaitCondVar + 0x88
4   org.mozilla.firefox 	0x000b941c
nsHostResolver::GetHostToLookup(nsHostRecord**) + 0x84
5   org.mozilla.firefox 	0x000b975c nsHostResolver::ThreadFunc(void*) + 0xa4
6   libnspr4.dylib      	0x00da06d0 PR_Select + 0x33c
7   libSystem.B.dylib   	0x900247e8 _pthread_body + 0x28

Thread 5:
0   libSystem.B.dylib   	0x90018ce8 semaphore_timedwait_signal_trap + 0x8
1   libSystem.B.dylib   	0x9000e888 _pthread_cond_wait + 0x268
2   libnspr4.dylib      	0x00d9b5e8 PR_Unlock + 0x12c
3   libnspr4.dylib      	0x00d9b84c PR_WaitCondVar + 0x88
4   org.mozilla.firefox 	0x0006c664 nsIOThreadPool::ThreadFunc(void*) + 0x74
5   libnspr4.dylib      	0x00da06d0 PR_Select + 0x33c
6   libSystem.B.dylib   	0x900247e8 _pthread_body + 0x28

PPC Thread State:
  srr0: 0x0045305c srr1: 0x0200f030                vrsave: 0x00000000
    cr: 0x24802228  xer: 0x00000004   lr: 0x00452e28  ctr: 0x00da4a08
    r0: 0x0000003f   r1: 0xbfffece0   r2: 0x00980000   r3: 0x00000000
    r4: 0x00000000   r5: 0x00000000   r6: 0xbfffed20   r7: 0x08159330
    r8: 0xbffff0a0   r9: 0xbfffed38  r10: 0x0a9e2284  r11: 0x00000000
   r12: 0x00da4a08  r13: 0xbffff2a0  r14: 0xbffff1cc  r15: 0xbffff1c8
   r16: 0x08159330  r17: 0x0333cb90  r18: 0xbffff2c0  r19: 0xbffff150
   r20: 0xbffff310  r21: 0x00000000  r22: 0x035920a0  r23: 0x00000004
   r24: 0x0090505c  r25: 0x00900000  r26: 0x009f02b8  r27: 0x0508932c
   r28: 0xbfffed20  r29: 0xbfffef00  r30: 0x0a9cb95c  r31: 0xbfffede0

Binary Images Description:
    0x1000 -   0x95ffff org.mozilla.firefox 0.8.0+
/Volumes/Firefox/Firefox.app/Contents/MacOS/firefox-bin
  0xd83000 -   0xdb6fff libnspr4.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libnspr4.dylib
 0x1e0a000 -  0x1e0cfff com.apple.textencoding.unicode 1.6.4
/System/Library/TextEncodings/Unicode Encodings.bundle/Contents/MacOS/Unicode
Encodings
 0x1ec0000 -  0x1edffff libnssckbi.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libnssckbi.dylib
 0x2000000 -  0x200dfff libplds4.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libplds4.dylib
 0x3000000 -  0x300efff libplc4.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libplc4.dylib
 0x4000000 -  0x4067fff libmozjs.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libmozjs.dylib
 0x5000000 -  0x5082fff libxpcom.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libxpcom.dylib
 0x6000000 -  0x601afff libssl3.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libssl3.dylib
 0x7000000 -  0x705cfff libnss3.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libnss3.dylib
 0x8000000 -  0x801dfff libsmime3.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libsmime3.dylib
 0x9000000 -  0x9079fff libsoftokn3.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libsoftokn3.dylib
 0xa000000 -  0xa019fff libxpcom_compat.dylib 
/Volumes/Firefox/Firefox.app/Contents/MacOS/libxpcom_compat.dylib
0x87ff0000 - 0x87ff1fff DVComponentGlue 
/System/Library/Frameworks/DVComponentGlue.framework/Versions/A/DVComponentGlue
0x8fe00000 - 0x8fe4ffff dyld 	/usr/lib/dyld
0x90000000 - 0x90122fff libSystem.B.dylib 	/usr/lib/libSystem.B.dylib
0x90190000 - 0x9023dfff com.apple.CoreFoundation 6.3.3 (299.3)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
0x90280000 - 0x904f9fff com.apple.CoreServices.CarbonCore 10.3.3
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
0x90570000 - 0x905defff com.apple.framework.IOKit 1.3.2 (???)
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
0x90610000 - 0x90699fff com.apple.CoreServices.OSServices 3.0 (3.0.0)
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
0x90700000 - 0x90700fff com.apple.CoreServices 10.3 (???)
/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
0x90720000 - 0x90787fff com.apple.audio.CoreAudio 2.1.2
/System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
0x907f0000 - 0x907f9fff com.apple.DiskArbitration 2.0.2
/System/Library/PrivateFrameworks/DiskArbitration.framework/Versions/A/DiskArbitration
0x90810000 - 0x90810fff com.apple.ApplicationServices 1.0 (???)
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
0x90910000 - 0x90983fff com.apple.DesktopServices 1.2.1
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
0x90d00000 - 0x90d1bfff com.apple.SystemConfiguration 1.7.1 (???)
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
0x90d40000 - 0x90d40fff com.apple.Carbon 10.3 (???)
/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
0x910b0000 - 0x910fffff com.apple.bom 1.2.4 (63)
/System/Library/PrivateFrameworks/Bom.framework/Versions/A/Bom
0x91200000 - 0x91203fff com.apple.URLMount 2.1
/System/Library/PrivateFrameworks/URLMount.framework/URLMount
0x912a0000 - 0x912bdfff com.apple.audio.SoundManager 3.8
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CarbonSound.framework/Versions/A/CarbonSound
0x912e0000 - 0x912f7fff com.apple.LangAnalysis 1.5.4
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
0x91320000 - 0x913defff ColorSync 
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSync.framework/Versions/A/ColorSync
0x91460000 - 0x91473fff com.apple.speech.synthesis.framework 3.2
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
0x914a0000 - 0x91509fff com.apple.htmlrendering 1.1.2
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HTMLRendering.framework/Versions/A/HTMLRendering
0x91560000 - 0x91619fff com.apple.QD 3.4.63 (???)
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
0x91670000 - 0x916a8fff com.apple.AE 1.3.2
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
0x916e0000 - 0x91773fff com.apple.print.framework.PrintCore 3.3
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
0x917e0000 - 0x917f0fff com.apple.speech.recognition.framework 3.3
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
0x91810000 - 0x9182afff com.apple.openscripting 1.2.1 (???)
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
0x91850000 - 0x91860fff com.apple.ImageCapture 2.1.0
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
0x91890000 - 0x9189cfff com.apple.help 1.0.1
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
0x918c0000 - 0x918cdfff com.apple.CommonPanels 1.2.1 (1.0)
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
0x918f0000 - 0x9193efff com.apple.print.framework.Print 3.3
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
0x91990000 - 0x9199bfff com.apple.securityhi 1.2 (90)
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
0x919c0000 - 0x91a33fff com.apple.NavigationServices 3.3.1
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/NavigationServices.framework/Versions/A/NavigationServices
0x91ab0000 - 0x91ac4fff libCGATS.A.dylib 
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
0x91ae0000 - 0x91aebfff libCSync.A.dylib 
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
0x91b10000 - 0x91b2afff libPDFRIP.A.dylib 
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libPDFRIP.A.dylib
0x91b50000 - 0x91b5ffff libPSRIP.A.dylib 
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libPSRIP.A.dylib
0x91b80000 - 0x91b93fff libRIP.A.dylib 
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
0x91bb0000 - 0x91d44fff com.apple.QuickTime 6.5.0
/System/Library/Frameworks/QuickTime.framework/Versions/A/QuickTime
0x92070000 - 0x92096fff com.apple.FindByContent 1.4 (1.2)
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/FindByContent.framework/Versions/A/FindByContent
0x920c0000 - 0x922a7fff com.apple.security 2.2 (164.1)
/System/Library/Frameworks/Security.framework/Versions/A/Security
0x92430000 - 0x92468fff com.apple.LaunchServices 10.3 (84)
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
0x92740000 - 0x92777fff com.apple.CFNetwork 1.2.1 (7)
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
0x927d0000 - 0x92b54fff com.apple.HIToolbox 1.3.2 (???)
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
0x92d30000 - 0x92d80fff com.apple.HIServices 1.4.0 (0.0.1d1)
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
0x935d0000 - 0x938a6fff com.apple.CoreGraphics 1.203.12 (???)
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
0x939a0000 - 0x939b4fff libcups.2.dylib 	/usr/lib/libcups.2.dylib
0x939d0000 - 0x939d4fff libmathCommon.A.dylib 	/usr/lib/system/libmathCommon.A.dylib
0x94060000 - 0x94078fff com.apple.WebServices 1.1.1 (1.1.0)
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/WebServicesCore.framework/Versions/A/WebServicesCore
0x945b0000 - 0x945b9fff libz.1.dylib 	/usr/lib/libz.1.dylib
0x94610000 - 0x9462afff libresolv.9.dylib 	/usr/lib/libresolv.9.dylib
0x94650000 - 0x946affff com.apple.SearchKit 1.0.2
/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
0x94b20000 - 0x94bacfff com.apple.ink.framework 1.1.1 (55.6)
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
0x968d0000 - 0x969b2fff libicucore.A.dylib 	/usr/lib/libicucore.A.dylib
0x96a20000 - 0x96ae2fff libcrypto.0.9.7.dylib 	/usr/lib/libcrypto.0.9.7.dylib
0x96b40000 - 0x96b6efff libssl.0.9.7.dylib 	/usr/lib/libssl.0.9.7.dylib
0x96bf0000 - 0x96c7ffff ATS 
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
0xc0000000 - 0xc000efff com.unsanity.ape 1.4.1
/Library/Frameworks/ApplicationEnhancer.framework/Versions/A/ApplicationEnhancer
Confirming on Windows XP, build 20040419
Last working build where it didnt crash was 20040416
Keywords: crash, regression
OS: MacOS X → All
Hardware: Macintosh → All
I can also confirm this crash on WinXP SP1, with UA:

Mozilla/5.0 (Windows; compatible; U; Windows NT 5.1; en-US; rv:1.8a)
Gecko/20040419 Firefox/0.8.0+
I've seen this intermittently on Linux, typing in the textfield in
http://www.google.com/ , but I can't reproduce reliably.  I do have some core
files that are debuggable, although in a non-DEBUG build.

I suspect this is a regression from varga's tree landing.

This is showing up as the top crash in firefox trunk talkback.

From the core file, I can say that the crash is caused by the |this| pointer for
one of the |GetAttr| calls in the function being either null or corrupt (not
deleted).  This is because I can see that the crash is when loading the vtable
pointer before a function call that's going to be the function at offset 0x50 in
the vtable (and it's a function call with four parameters -- including |this|,
of course).
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: topcrash
Summary: Crash when trying to enter text in input field. → Crash when trying to enter text in input field. [@ nsTreeBodyFrame::PrefillPropertyArray][@ _ZN15nsTreeBodyFrame20PrefillPropertyArrayEiP12nsTreeColumn]
It proabably fails in nsTreeColumn::GetContent()
nsIContent* GetContent() { return mFrame->GetContent(); };
Reassigning
Assignee: bugs → varga
*** Bug 241169 has been marked as a duplicate of this bug. ***
The April, 23 version still has this problem.
It crashes for me too with 20040422 build not only for that site, but for other
sites too and it's a random thing... usually after open again Firefox it was
working.
Haven't encountered any crashes, but sometimes a single keystroke in an input
field registers two or three times on my WinXP system. The last build that
didn't have this problem was also 2004-04-16.
(Perhaps the different behavior is because I don't have Autocomplete on...
whatever it is, I'm guessing the two bugs came about because of the same change.)
(In reply to comment #8)
> Haven't encountered any crashes, but sometimes a single keystroke in an input
> field registers two or three times on my WinXP system. The last build that
> didn't have this problem was also 2004-04-16.

I've also seen the same strange behavior...but, also in the address field in the
toolbar.
Happens for me on 24th build, almost repeatedly on dictionary.com, if the word I
am typing has auto complete matches.

Disabling auto complete as suggested does stop the crash.
(In reply to comment #10)
> also in the address field in the toolbar.

No problem with input fields (autocomplete=off). But always a crash writting
into the adressbar. So not sure if Bug 241371 is a dupe of this.

I tried to reproduce this problem on my system Saturday evening and could not. 
www.a9.com would not give me previous entries (e.g. magnetic pole, magnetic
flux, magnetic field).   This morning I tried again and observed the failure. 
The key points being that Firefox had been closed and started at least once
between tests and I had never visited www.a9.com prior to Saturday's test.   

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a) Gecko/20040424
Firefox/0.8.0+
Win2K SP4
Crashed with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a)
Gecko/20040424 Firefox/0.8.0+
while trying to type a name into yahoo mail
Flags: blocking0.9?
This has got to be a blocker... if we release with this I don't want to be the 
one to deal with the dupes this will generate. 
Flags: blocking0.9? → blocking0.9+
But varga's checkin was checked into the trunk after 1.8a opened, and 0.9 will
be based on the branch so this bug shouldn't even affect the branch at all.
Flags: blocking0.9+ → blocking0.9-
Happens fairly frequently using official 20040426 build on Linux.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a) Gecko/20040426 Firefox/0.8.0+
(daihard: XFT+GTK2; opt. for P4/SSE-2)

I managed to crash Firefox by typing into a text field on the xe.com Universal
Currency Converter page at www.xe.com/ucc. Subsequent attempts to trigger it
again all failed.
Flags: blocking1.0?
I get this crash even when typing in the address and search toolbars.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a) Gecko/20040425
Freebird/0.8.0+ (Krueger)
See comment 16; this problem resulted from a trunk checkin, so it only affects
the trunk.  Firefox 1.0 is coming from the branch.  Therefore, this problem *is
not* and *will not* be in Firefox 1.0.
Flags: blocking1.0?
Flags: blocking1.0?
Sorry forgot Firefox 1.0 owuld be built off the 1.7 branch and not 1.8.  Should
have read previous comments.
Flags: blocking1.0? → blocking1.0-
Flags: blocking1.0-
Flags: blocking0.9-
Whiteboard: Bug exists on trunk only, does not affect Fx 0.9 or 1.0
(In reply to comment #16)
> But varga's checkin was checked into the trunk after 1.8a opened, and 0.9 will
> be based on the branch so this bug shouldn't even affect the branch at all.

Do you know the particular checkin that caused this problem? There are quite a few by vargas from the 15th to the 20th.
The last build I've used without a problem was on the 16th.  Burning Edge
indicated this appeared around the 17th.  
It's the big one, for bug 221619.
(In reply to comment #24)
> It's the big one, for bug 221619.

I was just looking at that one. There wouldn't be an automatic backout tool, would there?
> There wouldn't be an automatic backout tool, would there?

Use bonsai.mozilla.org, it can dump cvs join commands to undo any change.

/be
Flags: blocking0.9?
Flags: blocking0.9?
Whiteboard: Bug exists on trunk only, does not affect Fx 0.9 or 1.0 → DO NOT SET ANY BLOCKING0.9 OR BLOCKING 1.0 FLAGS!
It's kind of odd how some people seem to experience this bug yet some others
don't.  I was experiencing it about a week ago.  But since then (due to some
unrelated problems) I had to reinstall WinXP.  And I just tried today's build
(0502) and I am not experiencing it anymore.
I experience this bug a LOT more frequently on Win98 (almost every time I type)
than I do on Windows XP (1 time in three days of normal usage).
*** Bug 242363 has been marked as a duplicate of this bug. ***
I can reproduce it on my old laptop finally. It will take some time to debug it
since the laptop is awfully slow for development :(
Status: NEW → ASSIGNED
I also experienced this on Windows 2000 using the 20040429 build and it would
happen with various sites and usually when I would have multiple tabs open and
while switching to a new (existing) tab while another tab was refreshing, I
would get the crash if I tried to enter data in an input field on the new
(existing) tab to which I just switched.  (Confusing I know... :)).

Peace...
Attached patch quick fixSplinter Review
Ok, so the column cache contains stale column info. It's actually the comment
column in autocomplete that is removed lazily.
Attachment #147559 - Flags: superreview?(dbaron)
Attachment #147559 - Flags: review?(neil.parkwaycc.co.uk)
Attachment #147559 - Flags: superreview?(dbaron) → superreview+
Attachment #147559 - Flags: review?(neil.parkwaycc.co.uk) → review+
fixed
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
*** Bug 236792 has been marked as a duplicate of this bug. ***
I'm getting a new crash in thunderbird message compose after this fix. bug 243203
*** Bug 226695 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsTreeBodyFrame::PrefillPropertyArray] [@ _ZN15nsTreeBodyFrame20PrefillPropertyArrayEiP12nsTreeColumn]
You need to log in before you can comment on or make changes to this bug.