Widgets don't stop repeating when disposed->crash

VERIFIED FIXED

Status

()

P2
major
VERIFIED FIXED
20 years ago
20 years ago

People

(Reporter: sfraser_bugs, Assigned: mikepinkerton)

Tracking

Trunk
PowerPC
All
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

20 years ago
Reported by Stewart Rubenstein <sdr@camsoft.com>:

You get a repeatable crash if you close the window in viewer_debug (I
pulled this version down Tuesday evening).

I looked into this, and found that the nsTextWidgets for the location
and status were not being disposed of, so they never call
StopRepeating(), but the window and all the controls have gone away, so
when nsTextWidget::RepeatAction calls StartDraw(), Bad Things Happen.

I guess someone is holding a reference too long, or perhaps when the
window goes away, it has to make sure all the widgets have been
destroyed.  My next move would be to turn on MOZ_TRACE_XPCOM_REFCNT, but
I'm not sure where or how to do that.

Updated

20 years ago
OS: All

Comment 1

20 years ago
Funny: it confirms what I saw just 5 minutes ago (!) when switching from a page
to another one. It doesn't happen very often, though. Maybe you are already
running with the 0xEFEF stuff...

Mike, a thing to investigate is whether a widget should delete its children when
it's deleted itself. I'm not sure... Maybe.

Comment 2

20 years ago
I have found two problems, one I've got a fix for, and one I don't.
First is around line 430 of mozilla/gfx/src/mac/nsRenderingContextMac.cpp

      if (NS_SUCCEEDED(children->CurrentItem((nsISupports **)&child)))
      {
      	nsRect childRect;
      	Rect macRect;
      	child->GetBounds(childRect);
      	NS_RELEASE(child); // SDR 1/22/1999 Add missing release
      	::SetRect(&macRect, childRect.x, childRect.y, childRect.x +
childRect.width, childRect.y + childRect.height);
      	::RectRgn(childRgn, &macRect);
      	::DiffRgn(myRgn, childRgn, myRgn);
      }
	delete children;

The second is that the destructor for nsBaseWidget::Enumerator is not being
called in the last line of that snippet.  I added a missing "virtual" keyword to
its definition, but for some reason (maybe I need to do a more thorough
rebuilding) it still isn't called.

-Stew <sdr@camsoft.com>

Comment 3

20 years ago
I have found two problems, one I've got a fix for, and one I don't.
First is around line 430 of mozilla/gfx/src/mac/nsRenderingContextMac.cpp

      if (NS_SUCCEEDED(children->CurrentItem((nsISupports **)&child)))
      {
      	nsRect childRect;
      	Rect macRect;
      	child->GetBounds(childRect);
      	NS_RELEASE(child); // SDR 1/22/1999 Add missing release
      	::SetRect(&macRect, childRect.x, childRect.y, childRect.x +
childRect.width, childRect.y + childRect.height);
      	::RectRgn(childRgn, &macRect);
      	::DiffRgn(myRgn, childRgn, myRgn);
      }
	delete children;

The second is that the destructor for nsBaseWidget::Enumerator is not being
called in the last line of that snippet.  I added a missing "virtual" keyword to
its definition, but for some reason (maybe I need to do a more thorough
rebuilding) it still isn't called.

-Stew <sdr@camsoft.com>

Comment 4

20 years ago
Don't forget: we have 3 similar cases of scanning through the children in
nsWindow.cpp
(Assignee)

Updated

20 years ago
Status: NEW → RESOLVED
Last Resolved: 20 years ago
Resolution: --- → FIXED
Fixed the one here, and the three in nsWindow by using nsCOMPtr. Added a comment
thanking Stewart in nsRenderingContextMac.cpp

Updated

20 years ago
QA Contact: 3819

Comment 6

20 years ago
will mark verified assuming reporter agrees with fix

Updated

20 years ago
Status: RESOLVED → VERIFIED

Comment 7

20 years ago
didn't hear any complaining, so marking verified

Comment 8

20 years ago
Moving all Widget Set bugs, past and present, to new HTML Form Controls
component per request from karnaze.  Widget Set component will be retired
shortly.
You need to log in before you can comment on or make changes to this bug.