Closed Bug 267863 Opened 15 years ago Closed 5 years ago

[@ PresShell::FlushPendingNotifications]

Categories

(Core :: Web Painting, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED INCOMPLETE

People

(Reporter: timeless, Unassigned)

Details

(Keywords: crash)

Crash Data

steps:
run winembed
load javascript:
tools>web development>javascript debugger

wait a while (i'm using some evil debugging sets)

vnk: Application venkman, 'JavaScript Debugger' loaded.
vnk: init {XPC - Begin deferred Release of 2573 nsISupports pointers
XPC - End deferred Releases

vnk:   initDebugger {XPC - Begin deferred Release of 372 nsISupports pointers
XPC - End deferred Releases
XPC - Begin deferred Release of 0 nsISupports pointers
XPC - End deferred Releases
XPC - Begin deferred Release of 0 nsISupports pointers
XPC - End deferred Releases
XPC - Begin deferred Release of 0 nsISupports pointers
XPC - End deferred Releases
} initDebugger 48.959 sec
XPC - Begin deferred Release of 20 nsISupports pointers
XPC - End deferred Releases
++WEBSHELL == 5
++DOMWINDOW == 5
vnk: } 91.373 sec
XPC - Begin deferred Release of 2935 nsISupports pointers
XPC - End deferred Releases
###!!! ASSERTION: Cannot process pending updates with refresh 
disabled: 'mRefreshEnabled', file r:/mozilla/view/src/nsViewManager.cpp, line 
1578
Break: at file r:/mozilla/view/src/nsViewManager.cpp, line 1578
XPC - Begin deferred Release of 91 nsISupports pointers
XPC - End deferred Releases
vnk: Application venkman, 'JavaScript Debugger' loaded.
vnk: init {XPC - Begin deferred Release of 2571 nsISupports pointers
XPC - End deferred Releases

vnk:   initDebugger {
vnk:     ack, all equal?
vnk:     ack, all equal?
vnk:     ack, all equal?
vnk:     ack, all equal?
vnk:     ack, all equal?
vnk:     ack, all equal?
vnk:     ack, all equal?
XPC - Begin deferred Release of 1408 nsISupports pointers
XPC - End deferred Releases
XPC - Begin deferred Release of 2 nsISupports pointers
XPC - End deferred Releases
vnk:   } initDebugger 56.127 sec
XPC - Begin deferred Release of 20 nsISupports pointers
XPC - End deferred Releases
++WEBSHELL == 6
++DOMWINDOW == 6
vnk: } 97.855 sec
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(EnsureScriptEnvironment())) failed, file 
r:/mozilla/docshell/base/nsWebShell.cpp, line 299
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(EnsureScriptEnvironment())) failed, file 
r:/mozilla/docshell/base/nsWebShell.cpp, line 299
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(EnsureScriptEnvironment())) failed, file 
r:/mozilla/docshell/base/nsWebShell.cpp, line 299
###!!! ASSERTION: Invalid batch count!: 'mUpdateBatchCnt >= 0', file 
r:/mozilla/view/src/nsViewManager.cpp, line 3314
Break: at file r:/mozilla/view/src/nsViewManager.cpp, line 3314
XPC - Begin deferred Release of 930 nsISupports pointers
--WEBSHELL == 5
XPC - End deferred Releases
vnk: Application venkman, 'JavaScript Debugger' loaded.
vnk: init {XPC - Begin deferred Release of 2638 nsISupports pointers
--DOMWINDOW == 5
XPC - End deferred Releases

vnk:   ack, all equal?
vnk:   ack, all equal?
vnk:   ack, all equal?
vnk:   initDebugger {
vnk:     ack, all equal?
vnk:     ack, all equal?
vnk:     ack, all equal?
vnk:     ack, all equal?
XPC - Begin deferred Release of 1477 nsISupports pointers
XPC - End deferred Releases
XPC - Begin deferred Release of 0 nsISupports pointers
XPC - End deferred Releases
vnk:   } initDebugger 56.795 sec
XPC - Begin deferred Release of 20 nsISupports pointers
XPC - End deferred Releases
++WEBSHELL == 6
++DOMWINDOW == 6
vnk: } 101.801 sec
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(EnsureScriptEnvironment())) failed, file 
r:/mozilla/docshell/base/nsWebShell.cpp, line 299
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(EnsureScriptEnvironment())) failed, file 
r:/mozilla/docshell/base/nsWebShell.cpp, line 299
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(EnsureScriptEnvironment())) failed, file 
r:/mozilla/docshell/base/nsWebShell.cpp, line 299

>	gklayout.dll!PresShell::FlushPendingNotifications(mozFlushType 
aType=Flush_Layout)  Line 5020 + 0x3	C++
 	gklayout.dll!nsDocument::FlushPendingNotifications(mozFlushType 
aType=Flush_Layout)  Line 4056	C++
 	gklayout.dll!nsHTMLDocument::FlushPendingNotifications(mozFlushType 
aType=Flush_Layout)  Line 1261	C++
 	gklayout.dll!nsHTMLDocument::GetPixelDimensions(nsIPresShell * 
aShell=0x04007af0, int * aWidth=0x0012f0b0, int * aHeight=0x0012f0dc)  Line 2491
	C++
 	gklayout.dll!nsHTMLDocument::GetHeight(int * aHeight=0x00000000)  Line 
2574 + 0xd	C++
 	xpcom_core.dll!XPTC_InvokeByIndex(nsISupports * that=0x039a67d4, 
unsigned int methodIndex=0x00000004, unsigned int paramCount=0x00000001, 
nsXPTCVariant * params=0x0012f0dc)  Line 102	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, 
XPCWrappedNative::CallMode mode=CALL_GETTER)  Line 2037 + 0x15	C++
 	xpc3250.dll!XPC_WN_GetterSetter(JSContext * cx=0x02d3ed50, JSObject * 
obj=0x036d6758, unsigned int argc=0x00000000, long * argv=0x02aad0e4, long * 
vp=0x0012f34c)  Line 1319 + 0xb	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x00f5ac74, unsigned int 
argc=0x00f5ac74, unsigned int flags=0x003551c8)  Line 1286 + 0x11	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x02d3ed50, JSObject * 
obj=0x036d6758, long fval=0x03ad9eb8, unsigned int flags=0x00000000, unsigned 
int argc=0x03f7cb34, long * argv=0x00000000, long * rval=0x0012f5f8)  Line 1430 
+ 0x13	C
 	js3250.dll!js_InternalGetOrSet(JSContext * cx=0x02d3ed50, JSObject * 
obj=0x036d6758, long id=0x02aabf50, long fval=0x03ad9eb8, JSAccessMode 
mode=JSACC_READ, unsigned int argc=0x00000000, long * argv=0x00000000, long * 
rval=0x0012f5f8)  Line 1474 + 0x19	C
 	js3250.dll!js_GetProperty(JSContext * cx=0x02d3ed50, JSObject * 
obj=0x036d6758, long id=0x02aabf50, long * vp=0x0012f5f8)  Line 2683 + 0x1d
	C
 	js3250.dll!js_Interpret(JSContext * cx=0x00f5ac74, long * 
result=0x003551c8)  Line 3297 + 0xb9	C
 	js3250.dll!js_Invoke(JSContext * cx=0x00f5ac74, unsigned int 
argc=0x00f5ac74, unsigned int flags=0x003551c8)  Line 1306 + 0xa	C
 	js3250.dll!js_Interpret(JSContext * cx=0x00f5ac74, long * 
result=0x003551c8)  Line 3502	C
 	js3250.dll!js_Invoke(JSContext * cx=0x00f5ac74, unsigned int 
argc=0x00f5ac74, unsigned int flags=0x003551c8)  Line 1306 + 0xa	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x02d3ed50, JSObject * 
obj=0x016b97d0, long fval=0x0412d7e0, unsigned int flags=0x00000000, unsigned 
int argc=0x02d3ed7c, long * argv=0x0397b470, long * rval=0x0012fa30)  Line 1430 
+ 0x13	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x02d3ed50, JSObject * 
obj=0x016b97d0, long fval=0x0412d7e0, unsigned int argc=0x00000001, long * 
argv=0x0397b470, long * rval=0x0012fa30)  Line 3783 + 0x16	C
 	gklayout.dll!nsJSContext::CallEventHandler(JSObject * 
aTarget=0x016b97d0, JSObject * aHandler=0x0412d7e0, unsigned int 
argc=0x00000001, long * argv=0x0397b470, long * rval=0x0012fa30)  Line 1357 + 
0x18	C++
 	gklayout.dll!GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 
aTimeout=0x003551c8)  Line 5016	C++
 	gklayout.dll!GlobalWindowImpl::TimerCallback(nsITimer * 
aTimer=0x03e16608, void * aClosure=0x03f6f0d8)  Line 5382	C++
 	xpcom_core.dll!nsTimerImpl::Fire()  Line 383 + 0x7	C++
 	xpcom_core.dll!handleTimerEvent(TimerEventType * event=0x03c50498)  
Line 448 + 0x7	C++
 	xpcom_core.dll!PL_HandleEvent(PLEvent * self=0x03c50498)  Line 693
	C
 	xpcom_core.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x00fc43f8)  
Line 628	C
 	xpcom_core.dll!nsEventQueueImpl::ProcessPendingEvents()  Line 395
	C++
 	gkwidget.dll!nsWindow::DispatchPendingEvents()  Line 3721	C++
 	gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=0x00000105, 
unsigned int wParam=0x00000009, long lParam=0xa00f0001, long * 
aRetValue=0x0012fda0)  Line 4092	C++
 	gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x002a0b78, unsigned 
int msg=0x00000105, unsigned int wParam=0x00000009, long lParam=0x02e328dc)  
Line 1355 + 0x10	C++
 	user32.dll!77d43a50() 	
 	user32.dll!77d43b1f() 	
 	user32.dll!GetMessageW()  + 0x125	
 	user32.dll!DispatchMessageA()  + 0xb	
 	winEmbed.exe!main(int argc=0x00000001, char * * argv=0x00357b80)  Line 
188 + 0x10	C++
 	winEmbed.exe!mainCRTStartup()  Line 400 + 0x11	C
 	kernel32.dll!TermsrvAppInstallMode()  + 0x269	

-	this	0x04007af0 {mRefCnt={mValue=0x00000001 } _mOwningThread=
{mThread=0x003551c8 } gLog=0x01669288 {name=0x01669450 "PresShell" 
level=PR_LOG_NONE next=0x01646c48 {name=0x01646a38 "htmlcontentsink" 
level=PR_LOG_NONE next=0x015bfcf0 {name=0x015bfcb0 level=PR_LOG_NONE 
next=0x015bf948 } } } ...}	PresShell * const
|-	nsIPresShell	{mDocument=0x039a65e8 {mChannel={mRawPtr=0x0412b008 
{mRefCnt={...} _mOwningThread={...} mSpec={...} ...} } 
mCompatMode=eCompatibility_FullStandards mImageMaps={...} ...} 
mPresContext=0x03ba4860 {mRefCnt={mValue=0x00000001 } _mOwningThread=
{mThread=0x003551c8 } mType=eContext_Galley ...} mStyleSet=0x03b53028 
{gQuirkURI=0x0166e498 mSheets=0x03b53028 mRuleProcessors=0x03b53060 
{mRawPtr=0x03ddc3f8 {mRefCnt={...} _mOwningThread={...} mSheets=
{...} ...} } ...} ...}	nsIPresShell
||+	nsIPresShell_base	{...}	nsIPresShell_base
||+	mDocument	0x039a65e8 {mChannel={mRawPtr=0x0412b008 {mRefCnt=
{mValue=0x00000001 } _mOwningThread={mThread=0x003551c8 } mSpec={...} ...} } 
mCompatMode=eCompatibility_FullStandards mImageMaps={...} ...}	nsIDocument *
||+	mPresContext	0x03ba4860 {mRefCnt={mValue=0x00000001 } _mOwningThread=
{mThread=0x003551c8 } mType=eContext_Galley ...}	nsPresContext *
||+	mStyleSet	0x03b53028 {gQuirkURI=0x0166e498 mSheets=0x03b53028 
mRuleProcessors=0x03b53060 {mRawPtr=0x03ddc3f8 {mRefCnt={mValue=0x00000001 } 
_mOwningThread={mThread=0x003551c8 } mSheets={...} ...} } ...}	nsStyleSet *
||+	mFrameConstructor	0x040e3308 {mRestyleEventQueue=
{mRawPtr=0x00000000 } mDocument=0x039a65e8 {mChannel={mRawPtr=0x0412b008 
{mRefCnt={...} _mOwningThread={...} mSpec={...} ...} } 
mCompatMode=eCompatibility_FullStandards mImageMaps={...} ...} 
mInitialContainingBlock=0x03e35130 {mRect={x=0xdddddddd y=0xdddddddd 
width=0xdddddddd ...} mContent=0xdddddddd {sTabFocusModel=0x00000007 
mParentPtrBits=??? } mStyleContext=0xdddddddd {mParent=??? mChild=??? 
mEmptyChild=??? ...} ...} ...}	nsCSSFrameConstructor *
||+	mViewManager	0x00000000	nsIViewManager *
||+	mSelection	0x03f18a90 {mRefCnt={mValue=0x00000001 } _mOwningThread=
{mThread=0x003551c8 } mDomSelections=0x03f18a9c ...}	nsIFrameSelection *
||+	mFrameManager	{mPresShell=0x00000000 {mDocument=??? mPresContext=??? 
mStyleSet=??? ...} mStyleSet=0x03b53028 {gQuirkURI=0x0166e498 
mSheets=0x03b53028 mRuleProcessors=0x03b53060 {mRawPtr=0x03ddc3f8 {mRefCnt=
{...} _mOwningThread={...} mSheets={...} ...} } ...} mRootFrame=0x00000000 
{mRect={x=??? y=??? width=??? ...} mContent=??? mStyleContext=??? ...} ...}
	nsFrameManagerBase
|\	mStylesHaveChanged	0x00	unsigned char
|+	nsIViewObserver	{...}	nsIViewObserver
|+	nsStubDocumentObserver	{...}	nsStubDocumentObserver
|+	nsISelectionController	{...}	nsISelectionController
|+	nsIObserver	{...}	nsIObserver
|+	nsSupportsWeakReference	{mProxy=0x00000000 {mRefCount=??? 
mReferent=??? } }	nsSupportsWeakReference
|+	mRefCnt	{mValue=0x00000001 }	nsAutoRefCnt
|+	_mOwningThread	{mThread=0x003551c8 }	nsAutoOwningThread
|+	gLog	0x01669288 {name=0x01669450 "PresShell" level=PR_LOG_NONE 
next=0x01646c48 {name=0x01646a38 "htmlcontentsink" level=PR_LOG_NONE 
next=0x015bfcf0 {name=0x015bfcb0 "nsStreamPump" level=PR_LOG_NONE 
next=0x015bf948 {name=0x015bf910 level=PR_LOG_NONE next=0x014e8b60 } } } }
	PRLogModuleInfo *
|	mCaretEnabled	0x00000000	int
|	mBidiLevel	0x80 '€'	unsigned char
|+	mBidiKeyboard	{mRawPtr=0x01659d10 {mRefCnt={mValue=0x00000011 } 
_mOwningThread={mThread=0x003551c8 } mDefaultsSet=0x00000000 ...} }
	nsCOMPtr<nsIBidiKeyboard>
|	mInVerifyReflow	0x00000000	int
|+	mPrefStyleSheet	0x00000000	nsICSSStyleSheet *
|	mUpdateCount	0x00000000	unsigned int
|+	mReflowCommands	{mImpl=0x03dd4950 {mBits=0x80000008 mCount=0x00000000 
mArray=0x03dd4958 } }	nsVoidArray
|+	mReflowCommandTable	{ops=0x01af75f8 reflowCommandOps 
data=0x00000000 hashShift=0x001c ...}	PLDHashTable
|	mDocumentLoading	0x00	unsigned char
|	mIsReflowing	0x00	unsigned char
|	mIsDestroying	0x01 '␁'	unsigned char
|	mDidInitialReflow	0x01 '␁'	unsigned char
|	mIgnoreFrameDestruction	0x01 '␁'	unsigned char
|	mHaveShutDown	0x01 '␁'	unsigned char
|+	mCurrentEventFrame	0x00000000 {mRect={x=??? y=??? width=??? ...} 
mContent=??? mStyleContext=??? ...}	nsIFrame *
|+	mCurrentEventContent	{mRawPtr=0x00000000 {sTabFocusModel=0x00000007 
mParentPtrBits=??? } }	nsCOMPtr<nsIContent>
|+	mCurrentEventFrameStack	{mImpl=0x00000000 {mBits=??? mCount=??? 
mArray=0x00000008 } }	nsVoidArray
|+	mCurrentEventContentStack	{...}	nsCOMArray<nsIContent>
|+	mAnonymousContentTable	0x00000000	nsSupportsHashtable *
|+	mCurrentTargetRect	{x=0x00000000 y=0x00000000 width=0x00000000 ...}
	nsRect
|+	mCurrentTargetView	0x00000000 {mViewManager=??? mParent=??? 
mWindow=??? ...}	nsIView *
|+	mCaret	{mRawPtr=0x00000000 }	nsCOMPtr<nsICaret>
|	mSelectionFlags	0x0003	short
|	mBatchReflows	0x00	unsigned char
|+	mViewEventListener	0x00000000 {mRefCnt={mValue=??? } 
_mOwningThread={mThread=??? } mPresShell=??? ...}
	PresShellViewEventListener *
|+	mEventQueueService	{mRawPtr=0x00fe4ee0 {mRefCnt=
{mValue=0x0000002d } _mOwningThread={mThread=0x003551c8 } mEventQTable=
{...} ...} }	nsCOMPtr<nsIEventQueueService>
|+	mReflowEventQueue	{mRawPtr=0x00000000 }	nsCOMPtr<nsIEventQueue>
|+	mFrameArena	{mPool={first={next=0x040a7830 {next=0x03c6ef80 
base=0x040a7840 limit=0x040a8843 ...} base=0x04007c24 limit=0x04007c24 ...} 
current=0x03f1e028 {next=0x00000000 {next=??? base=??? limit=??? ...} 
base=0x03f1e038 limit=0x03f1f03b ...} arenasize=0x00001000 ...} 
mRecyclers=0x04007c34 }	FrameArena
|+	mStackArena	0x038f9fd0 {mPos=0x00000000 mBlocks=0x03e8c028 
{mBlock=0x03e8c028 "ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ
ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ
ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ
ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ" 
mNext=0x00000000 {mBlock=0x00000000 <Bad Ptr> mNext=??? } } 
mCurBlock=0x03e8c028 
{mBlock=0x03e8c028 "ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ
ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ
ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝ
ÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÝÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ" 
mNext=0x00000000 {mBlock=0x00000000 <Bad Ptr> mNext=??? } } ...}
	StackArena *
|+	mDragService	{mRawPtr=0x01644368 {mNativeDragSrc=0x00000000 
mNativeDragTarget=0x00000000 {m_cRef=??? mHWnd=??? mCanMove=??? ...} 
mDataObject=0x00000000 } }	nsCOMPtr<nsIDragService>
|	mRCCreatedDuringLoad	0x00000000	int
|+	mDummyLayoutRequest	{mRawPtr=0x00000000 }	nsCOMPtr<nsIRequest>
|+	mFirstDOMEventRequest	0x00000000 {content=??? event=??? next=??? }
	nsDOMEventRequest *
|+	mLastDOMEventRequest	0x00000000 {content=??? event=??? next=??? }
	nsDOMEventRequest *
|+	mFirstAttributeRequest	0x00000000 {content=??? nameSpaceID=??? 
name=??? ...}	nsAttributeChangeRequest *
|+	mLastAttributeRequest	0x00000000 {content=??? nameSpaceID=??? 
name=??? ...}	nsAttributeChangeRequest *
|+	mFirstCallbackEventRequest	0x00000000 {callback=??? next=??? }
	nsCallbackEventRequest *
|+	mLastCallbackEventRequest	0x00000000 {callback=??? next=??? }
	nsCallbackEventRequest *
|	mIsThemeSupportDisabled	0x00	unsigned char
|	mIsDocumentGone	0x01 '␁'	unsigned char
|	mPaintingSuppressed	0x01 '␁'	unsigned char
|	mShouldUnsuppressPainting	0x00	unsigned char
|+	mPaintSuppressionTimer	{mRawPtr=0x00000000 }	nsCOMPtr<nsITimer>
|+	mReflowCountMgr	0x00000000 {mCounts=??? mIndiFrameCounts=??? 
mFD=??? ...}	ReflowCountMgr *
\+	mResizeEventTimer	{mRawPtr=0x00000000 }	nsCOMPtr<nsITimer>
	aType	Flush_Layout	mozFlushType
	isSafeToFlush	0x00000001	int

From the looks of it, mViewManager was ok, until
       mFrameConstructor->ProcessPendingRestyles();

<bz_away> timeless: processing pending restyles can wipe out the presshell
reproducable: yes

note that you may crash somewhere else instead, but i've now crashed twice 
here :)
> <bz_away> timeless: processing pending restyles can wipe out the presshell

Processing pending restyles on the _parent_ can wipe out the presshell. 
Processing pending restyles on mFrameConstructor should have no effect on |this|.

Although, processing pending restyles can create XBL bindings, hence run arbitrary script, hence kill |this|.
Flags: blocking1.9?
It sounds like comment 2 and comment 3 may be extremely concise summaries of bugs that deserve [wanted-1.9] or blocking1.9+, but there's not enough information in this bug for such consideration, and the bug that appears to be describe here seems too obscure to merit either of those on its own.  Please file those as separate bugs if you still understand what you meant; you're welcome to renominate those.
Flags: blocking1.9? → blocking1.9-
The issue described in comment 3 is fixed by the patch for bug 267833.  So no need for a separate bug on that.
Is this still reproducable?
QA Contact: ian → layout.view-rendering
Crash Signature: [@ PresShell::FlushPendingNotifications]
Please reopen the bug if it's still reproducible in a recent version of Firefox.
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → INCOMPLETE
Component: Layout: View Rendering → Layout: Web Painting
You need to log in before you can comment on or make changes to this bug.