265902 - Crash [@ nsContainerFrame::SyncFrameViewProperties ]

Status: VERIFIED DUPLICATE of bug 265973

(Core :: Layout: Images, Video, and HTML Frames, defect)

Description

[Robert Strong (they/them - no direct email)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041024 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041024 Firefox/1.0

The soon to be attached simplified testcase causes a crash @
nsContainerFrame::SyncFrameViewProperties. TB1500741H

Reproducible: Always
Steps to Reproduce:
1. Opem testcase
2.
3.

Actual Results:  
Crash or hang

Expected Results:  
No crash or hang

UA's affected:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041024 Firefox/1.0
and
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041023

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1500741H

Stack Signature	 nsContainerFrame::SyncFrameViewProperties 8846df57

Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 860

Comment 1

[Robert Strong (they/them - no direct email)]

Attachment: Testcase (causes crash)

Comment 2

[Robert Strong (they/them - no direct email)]

Adding keywords crash and testcase.

Comment 3

[Boris Zbarsky [:bzbarsky]]

This worksforme with a current trunk build on Linux...

Comment 4

[Daniel Veditz [:dveditz]]

Trunk source from this morning crashes for me on windows, aFrame is null in
nsContainerFrame::PaintChild(). I don't see SyncFrameViewProperties on the stack
I get.

Comment 5

[Robert Strong (they/them - no direct email)]

I just sent Mozilla Trunk TB1535117M and Firefox Branch TB1536401G for this
testcase and it now has crashed for me on nsContainerFrame::PaintChild for both.
The original of TB1500741H was only for Firefox and since this latest round of
TalkBacks are for both perhaps the summary should be updated. I'll leave that to
someone more knowledgeable regarding the correct process.

Comment 6

[Robert Strong (they/them - no direct email)]

I suspect that this is a duplicate of bug 265973 or at least related.

Comment 7

[Jay Patel [:jay]]

Robert, you're right.  The couple of incidents I found in Talkback data that
referred to this bug have the same stack as bug 265973:

Incident ID: 1557621
Stack Signature	nsContainerFrame::PaintChild 1eaa9b99
Product ID	Firefox10
Build ID	2004102622
Trigger Time	2004-10-27 12:47:24.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001f55ef)
URL visited	https://bugzilla.mozilla.org/attachment.cgi?id=163259&action=view
User Comments	clicked to edit the attached testcase (bug 265902)
Since Last Crash	289 sec
Total Uptime	3544 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 244
Stack Trace 	
nsContainerFrame::PaintChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 244]
nsBlockFrame::PaintChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsBlockFrame::PaintChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/table/src/../../base/src\nsBlockFrame.h,
line 244]
nsBlockFrame::PaintChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5484]
nsHTMLContainerFrame::PaintDecorationsAndChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 141]
nsBlockFrame::Paint 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 5309]
nsContainerFrame::PaintChild 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 306]
nsContainerFrame::PaintChildren 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 230]
nsHTMLContainerFrame::Paint 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsHTMLContainerFrame.cpp,
line 88]
CanvasFrame::Paint 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsHTMLFrame.cpp,
line 394]
PresShell::Paint 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5559]
nsView::Paint 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 262]
nsViewManager::RenderDisplayListElement 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1452]
nsViewManager::RenderViews 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1370]
nsViewManager::Refresh 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 929]
nsViewManager::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1919]
HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::ProcessMessage 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3825]
nsWindow::WindowProc 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0xb368 (0x77d4b368)
USER32.dll + 0xb3b4 (0x77d4b3b4)
ntdll.dll + 0xeae3 (0x7c90eae3)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppShellService::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

*** This bug has been marked as a duplicate of 265973 ***

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified dup