260624 - Crash when scrolling overflow:auto div to bottom and then reloading page [@ nsGfxScrollFrameInner::GetScrollableView]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040919 Firefox/0.9.1+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040919 Firefox/0.9.1+

See the testcase.
Scroll the overflow:auto div to the bottom.
After that, reload the page.
Result -> the browser crashes.

It doesn't happen in:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a4) Gecko/20040911
Firefox/0.9.1+ 8:44 AM
It happens in:
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a4) Gecko/20040913
Firefox/0.9.1+ 9:46 AM

A talkback ID: TB903246X
The talkback server is busy right now. It can take a few days before that data
comes in. I haven't been able to get a backtrace with a debug build.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

(I wasn't able to find a (usable) Mozilla/Firefox build of 2004-09-12 in case
anyone wonders)

Comment 2

[Martijn Wargers (dead)]

Ok, I've build a debug build of 2004-9-11, verified that it did not crash with
the testcase.
After that I've applied the patch from bug 257916 (via CVS, the patch in that
bug would not apply cleanly), and rebuild.
After that my debug build consistently crashes on the testcase.
So I guess somehow, the fix for bug 257916 is the cause of this bug.

Comment 3

[Martijn Wargers (dead)]

Backing out the nsPresShell.cpp or nsScrollBoxFrame changes doesn't make the
crash disappear, so probably it has got something to do with the
nsGfxScrollFrame changes? (I couldn't back that part out, somehow it would not
compile)

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

This fixes it.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in

Comment 6

[Jay Patel [:jay]]

Marking verified per Talkback data.