Closed
Bug 270561
Opened 20 years ago
Closed 9 years ago
thunderbird + venkman crash [@ 0x61000010 - nsImageFrame::FrameChanged]
Categories
(Core :: Layout, defect, P5)
Tracking
()
RESOLVED
INCOMPLETE
People
(Reporter: timeless, Unassigned)
Details
(Keywords: crash, Whiteboard: [needs retesting by timeless once Venkman works again])
Crash Data
Date/Time: 2004-11-18 00:26:39 -0800
OS Version: 10.3.6 (Build 7R28)
Report Version: 2
Command: thunderbird-bin
Path: ./thunderbird-bin
Version: 0.6+ (0.6+)
PID: 14461
Thread: 0
Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_INVALID_ADDRESS (0x0001) at 0x61000010
Thread 0 Crashed:
0 <<00000000>> 0x61000010 0 + 0x61000010
1 libgklayout.dylib 0x03078678 nsImageFrame::FrameChanged(imgIContainer*,
gfxIImageFrame*, nsRect*) + 0x68
2 libgklayout.dylib 0x031d6660
nsImageLoadingContent::FrameChanged(imgIContainer*, gfxIImageFrame*, nsRect*) + 0x50
3 libimglib2.dylib 0x013445ac
imgRequestProxy::FrameChanged(imgIContainer*, gfxIImageFrame*, nsRect*) + 0x60
4 libimglib2.dylib 0x01342c0c imgRequest::FrameChanged(imgIContainer*,
gfxIImageFrame*, nsRect*) + 0x80
5 libimglib2.dylib 0x01348770 imgContainerGIF::Notify(nsITimer*) + 0x288
6 libxpcom_core.dylib 0x100468dc nsTimerImpl::Fire() + 0xc4
7 libxpcom_core.dylib 0x100469e8 handleTimerEvent(TimerEventType*) + 0x8c
8 libxpcom_core.dylib 0x10042984 PL_HandleEvent + 0x24
9 libxpcom_core.dylib 0x100428a8 PL_ProcessPendingEvents + 0x80
10 libxpcom_core.dylib 0x10042d8c _md_EventReceiverProc + 0x74
11 com.apple.HIToolbox 0x927d1fc8 DispatchEventToHandlers + 0x150
12 com.apple.HIToolbox 0x927d223c SendEventToEventTargetInternal + 0x174
13 com.apple.HIToolbox 0x927d66bc SendEventToEventTargetWithOptions + 0x28
14 com.apple.HIToolbox 0x927e2d54
ToolboxEventDispatcherHandler(OpaqueEventHandlerCallRef*, OpaqueEventRef*,
void*) + 0x2b8
15 com.apple.HIToolbox 0x927d2084 DispatchEventToHandlers + 0x20c
16 com.apple.HIToolbox 0x927d223c SendEventToEventTargetInternal + 0x174
17 com.apple.HIToolbox 0x927e46e4 SendEventToEventTarget + 0x28
18 com.apple.HIToolbox 0x927e8600 ToolboxEventDispatcher + 0x5c
19 com.apple.HIToolbox 0x927f8740 TryEventDispatcher + 0x6c
20 com.apple.HIToolbox 0x927d8db0 GetOrPeekEvent + 0x134
21 com.apple.HIToolbox 0x927d8f64 GetNextEventMatchingMask + 0xa0
22 com.apple.HIToolbox 0x927eca18 WNEInternal + 0xa0
23 com.apple.HIToolbox 0x927fd730 WaitNextEvent + 0x4c
24 libwidget_mac.dylib 0x0047fe70 nsMacMessagePump::GetEvent(EventRecord&) + 0x74
25 libwidget_mac.dylib 0x004742e4 nsAppShell::GetNativeEvent(int&, void*&) + 0x40
26 libjsd.dylib 0x004352d4
jsdService::EnterNestedEventLoop(jsdINestCallback*, unsigned*) + 0x238
27 libxpcom_core.dylib 0x1005a14c _XPTC_InvokeByIndex + 0xd8
28 libxpconnect.dylib 0x00738418
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 0x9dc
29 libxpconnect.dylib 0x0073e1ec XPC_WN_CallMethod(JSContext*, JSObject*,
unsigned, long*, long*) + 0xdc
30 libmozjs.dylib 0x06029960 js_Invoke + 0x6d0
31 libmozjs.dylib 0x06031444 js_Interpret + 0x6c88
32 libmozjs.dylib 0x060299a0 js_Invoke + 0x710
33 libxpconnect.dylib 0x0073417c
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo
const*, nsXPTCMiniVariant*) + 0x8f4
34 libxpcom_core.dylib 0x10059fe8 PrepareAndDispatch + 0x2f4
35 libxpcom_core.dylib 0x1005a98c SharedStub + 0x70
36 libjsd.dylib 0x0042fac8 jsds_ExecutionHookProc(JSDContext*,
JSDThreadState*, unsigned, void*, long*) + 0x2b8
37 libjsd.dylib 0x0042a5e8 jsd_CallExecutionHook + 0xa4
38 libmozjs.dylib 0x06033df0 js_Interpret + 0x9634
39 libmozjs.dylib 0x060299a0 js_Invoke + 0x710
40 libxpconnect.dylib 0x0073417c
nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo
const*, nsXPTCMiniVariant*) + 0x8f4
41 libxpcom_core.dylib 0x10059fe8 PrepareAndDispatch + 0x2f4
42 libxpcom_core.dylib 0x1005a98c SharedStub + 0x70
43 libmail.dylib 0x0257b268 nsMsgDBView::UpdateDisplayMessage(unsigned)
+ 0x1c4
44 libmail.dylib 0x0257b474
nsMsgDBView::LoadMessageByViewIndex(unsigned) + 0x124
45 libmail.dylib 0x0257b624 nsMsgDBView::SelectionChanged() + 0x130
46 libxpcom_core.dylib 0x1005a14c _XPTC_InvokeByIndex + 0xd8
47 libxpconnect.dylib 0x00738418
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 0x9dc
48 libxpconnect.dylib 0x0073e1ec XPC_WN_CallMethod(JSContext*, JSObject*,
unsigned, long*, long*) + 0xdc
49 libmozjs.dylib 0x06029960 js_Invoke + 0x6d0
50 libmozjs.dylib 0x06031444 js_Interpret + 0x6c88
51 libmozjs.dylib 0x060299a0 js_Invoke + 0x710
52 libmozjs.dylib 0x06029bac js_InternalInvoke + 0xb8
53 libmozjs.dylib 0x06007324 JS_CallFunctionValue + 0x2c
54 libgklayout.dylib 0x032cd100 nsJSContext::CallEventHandler(JSObject*,
JSObject*, unsigned, long*, long*) + 0x11c
55 libgklayout.dylib 0x032fc3c4 nsJSEventListener::HandleEvent(nsIDOMEvent*)
+ 0x3c8
56 libgklayout.dylib 0x031db968
nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEvent*,
nsIDOMEventTarget*, unsigned, unsigned) + 0x244
57 libgklayout.dylib 0x031dbc50
nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**,
nsIDOMEventTarget*, unsigned, nsEventStatus*) + 0x294
58 libgklayout.dylib 0x0331d0cc nsXULElement::HandleDOMEvent(nsPresContext*,
nsEvent*, nsIDOMEvent**, unsigned, nsEventStatus*) + 0x9b0
59 libgklayout.dylib 0x03310a38 nsTreeSelection::FireOnSelectHandler() + 0x184
60 libgklayout.dylib 0x0330fbe8 nsTreeSelection::Select(int) + 0x17c
61 libxpcom_core.dylib 0x1005a14c _XPTC_InvokeByIndex + 0xd8
62 libxpconnect.dylib 0x00738418
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 0x9dc
63 libxpconnect.dylib 0x0073e1ec XPC_WN_CallMethod(JSContext*, JSObject*,
unsigned, long*, long*) + 0xdc
64 libmozjs.dylib 0x06029960 js_Invoke + 0x6d0
65 libmozjs.dylib 0x06031444 js_Interpret + 0x6c88
66 libmozjs.dylib 0x060299a0 js_Invoke + 0x710
67 libmozjs.dylib 0x06029bac js_InternalInvoke + 0xb8
68 libmozjs.dylib 0x06007324 JS_CallFunctionValue + 0x2c
69 libgklayout.dylib 0x032cd100 nsJSContext::CallEventHandler(JSObject*,
JSObject*, unsigned, long*, long*) + 0x11c
70 libgklayout.dylib 0x032fc3c4 nsJSEventListener::HandleEvent(nsIDOMEvent*)
+ 0x3c8
71 libgklayout.dylib 0x0329ba3c
nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver*, nsIDOMEvent*) + 0xe30
72 libgklayout.dylib 0x032985e0 nsXBLEventHandler::HandleEvent(nsIDOMEvent*)
+ 0xe4
73 libgklayout.dylib 0x031db968
nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEvent*,
nsIDOMEventTarget*, unsigned, unsigned) + 0x244
74 libgklayout.dylib 0x031dbc50
nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**,
nsIDOMEventTarget*, unsigned, nsEventStatus*) + 0x294
75 libgklayout.dylib 0x0331d0cc nsXULElement::HandleDOMEvent(nsPresContext*,
nsEvent*, nsIDOMEvent**, unsigned, nsEventStatus*) + 0x9b0
76 libgklayout.dylib 0x0309ade0 PresShell::HandleEventInternal(nsEvent*,
nsIView*, unsigned, nsEventStatus*) + 0x278
77 libgklayout.dylib 0x0309aa50 PresShell::HandleEvent(nsIView*,
nsGUIEvent*, nsEventStatus*, int, int&) + 0x450
78 libgklayout.dylib 0x032c53dc nsViewManager::HandleEvent(nsView*,
nsGUIEvent*, int) + 0x328
79 libgklayout.dylib 0x032c475c nsViewManager::DispatchEvent(nsGUIEvent*,
nsEventStatus*) + 0xba0
80 libgklayout.dylib 0x032bcf2c HandleEvent(nsGUIEvent*) + 0x48
81 libwidget_mac.dylib 0x00495108 nsWindow::DispatchEvent(nsGUIEvent*,
nsEventStatus&) + 0xac
82 libwidget_mac.dylib 0x00495194 nsWindow::DispatchWindowEvent(nsGUIEvent&) +
0x20
83 libwidget_mac.dylib 0x00495260 nsWindow::DispatchMouseEvent(nsMouseEvent&)
+ 0x78
84 libwidget_mac.dylib 0x0047e698
nsMacEventHandler::HandleMouseDownEvent(EventRecord&) + 0x430
85 libwidget_mac.dylib 0x0047cbbc
nsMacEventHandler::HandleOSEvent(EventRecord&) + 0x184
86 libwidget_mac.dylib 0x00484ac8 nsMacWindow::DispatchEvent(void*, int*) + 0x38
87 libwidget_mac.dylib 0x00480c94
nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, OpaqueWindowPtr*) + 0x60
88 libwidget_mac.dylib 0x004807c8 nsMacMessagePump::DoMouseDown(EventRecord&)
+ 0x6c4
89 libwidget_mac.dylib 0x0047ff58 nsMacMessagePump::DispatchEvent(int,
EventRecord*) + 0xc4
90 libwidget_mac.dylib 0x0047fd5c nsMacMessagePump::DoMessagePump() + 0x40
91 libwidget_mac.dylib 0x004740c0 nsAppShell::Run() + 0x38
92 thunderbird-bin 0x0000d1b0 xre_main(int, char**, nsXREAppData const*) +
0xadc
93 thunderbird-bin 0x0000934c _start + 0x17c
94 thunderbird-bin 0x000091cc start + 0x30
PPC Thread State:
srr0: 0x61000010 srr1: 0x0200f030 vrsave: 0x00000000
cr: 0x44422222 xer: 0x00000000 lr: 0x0306621c ctr: 0x61000011
r0: 0x000000c3 r1: 0xbfffa830 r2: 0x0004be9b r3: 0x06500a00
r4: 0x0674c0e0 r5: 0xbfffa880 r6: 0x00000000 r7: 0xbfffa7b0
r8: 0x00000000 r9: 0x000017c2 r10: 0x00000393 r11: 0x44422228
r12: 0x61000011 r13: 0x00000000 r14: 0x00524480 r15: 0xbfffb6a0
r16: 0x00000000 r17: 0xbfffb5f0 r18: 0x00000000 r19: 0x00000000
r20: 0x00000002 r21: 0x00000000 r22: 0x05a8a770 r23: 0x00517550
r24: 0xbfffaab0 r25: 0x04b6c660 r26: 0x04b6c6c0 r27: 0x04b6c660
r28: 0x00000000 r29: 0x07f14958 r30: 0x00000000 r31: 0x013484f8
reproducable.
i installed the linux venkman xpi into my thunderbird macosx nightly.
i run ./thunderbird-bin -venkman -mail
venkman is set to debug chrome and stop for exception
thunderbird has a pop3 account and a rss feed account.
when i step through a few exceptions (right clicking the top frame in the call
stack and selecting don't debug) trying to read an rss entry, thunderbird
consistently crashes
Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x000002aa
Thread 0 Crashed:
0 libgklayout.dylib 0x03078638 nsImageFrame::FrameChanged(imgIContainer*,
gfxIImageFrame*, nsRect*) + 0x28
1 libgklayout.dylib 0x031d6660
nsImageLoadingContent::FrameChanged(imgIContainer*, gfxIImageFrame*, nsRect*) + 0x50
PPC Thread State:
srr0: 0x03078638 srr1: 0x0200f030 vrsave: 0x00000000
cr: 0x44422444 xer: 0x00000000 lr: 0x03078638 ctr: 0x0307b8e0
r0: 0x03078638 r1: 0xbfffc390 r2: 0x000002a9 r3: 0x000002a9
r4: 0x00000008 r5: 0x06153864 r6: 0xbfffc580 r7: 0x00000000
r8: 0x07b6efbd r9: 0x0339c29c r10: 0x000000ff r11: 0x0339c2fc
r12: 0x0307b8e0 r13: 0x00000000 r14: 0x00524510 r15: 0xbfffd170
r16: 0x00000000 r17: 0xbfffd0c0 r18: 0x00000000 r19: 0x00000000
r20: 0x00000003 r21: 0x00000000 r22: 0x056d7450 r23: 0x00517550
r24: 0xbfffc580 r25: 0x0496cba0 r26: 0x05619880 r27: 0x0496cba0
r28: 0xbfffc580 r29: 0x0496cba0 r30: 0x07d0912c r31: 0x013484f8Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x0000001c Thread 0 Crashed: 0 libgklayout.dylib 0x031b9120 nsStyleContext::GetStyleData(nsStyleStructID) + 0x34 1 libgklayout.dylib 0x03078638 nsImageFrame::FrameChanged(imgIContainer*, gfxIImageFrame*, nsRect*) + 0x28 2 libgklayout.dylib 0x031d6660 nsImageLoadingContent::FrameChanged(imgIContainer*, gfxIImageFrame*, nsRect*) + 0x50
|
||
Comment 3•20 years ago
|
||
This will happen any time an image frame is lost from the frame tree. I'd need a minimal testcase to even start trying to figure out why that happens here....
Keywords: qawanted
well, i'm crashing very consistently on osx using steps from comment #1, but i haven't managed to get camino, firefox or seamonkey to build here in the past week. and i'm not the person to try to reduce a testcase. i'm believe the last exception before death is the aim pref (in one case), my user start page may be interesting, it's an http server that of course doesn't render because thunderbird doesn't want to render those things: http://www.tiscali.be/FR/home/home_center.asp i pulled that page from gmail (looking for a crasher)
Summary: [@ 0x61000010 - nsImageFrame::FrameChanged] → crash [@ 0x61000010 - nsImageFrame::FrameChanged]
Status: UNCONFIRMED → NEW
Ever confirmed: true
Priority: -- → P5
|
||
Comment 5•19 years ago
|
||
timeless, anything else to investigate on this bug?
i don't have time or resources. i'm burnt out. very burnt out. unless bz/stuart/biesi say it's fixed, it's probably still not fixed. please do me a favor, limit the number of questions you ask of me to 2 per week. i can't possibly answer more than that. as is, i can't even keep up w/ the general flow of things anymore. i'm drowning.
|
|
||
Updated•19 years ago
|
Summary: crash [@ 0x61000010 - nsImageFrame::FrameChanged] → thunderbird + venkman crash [@ 0x61000010 - nsImageFrame::FrameChanged]
|
||
Comment 7•18 years ago
|
||
timeless, still seen?
i can't get venkman's call stack to work at all, so i can't select don't debug. as such, i can't follow my steps to reproduce (using 0.87 w/ a tb nightly from today). i guess that's worksforme, although i'd argue it's "blocked on venkman is broken". I also couldn't get venkman to pop out windows...
|
||
Updated•15 years ago
|
Keywords: qawanted
Whiteboard: [needs retesting by timeless once Venkman works again]
|
Assignee | |
Updated•13 years ago
|
Crash Signature: [@ 0x61000010 - nsImageFrame::FrameChanged]
|
||
Comment 9•9 years ago
|
||
nsImageFrame::FrameChanged doesn't exist anymore.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → INCOMPLETE
You need to log in
before you can comment on or make changes to this bug.
Description
•