281330 - Keeping Backspace pushed down when the history contains more than 2 entries occasionally causes a crash [@ nsView::Paint]

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Ryuichi KUBUKI]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050206 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050206 Firefox/1.0+

Pushing Backspace while loading a page occasionally causes a crash.

Incident ID: 3515509

	c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 335
Stack Trace 	
nsView::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 335]
nsIFrame::GetWindow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 2454]
nsIFrame::GetScreenRect 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 2327]
nsFrame::CheckInvalidateSizeChange 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsFrame.cpp,
line 2594]
SortByZOrder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1142]
nsViewManager::UpdateWidgetArea 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 1757]
nsView::DropMouseGrabbing 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 197]
nsWindow::SuppressBlurEvents 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1054]
nsWindow::MapFromNativeToDOM 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 2976]
nsWindow::OnKeyDown 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3155]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3980]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1339]
USER32.dll + 0x8709 (0x77cf8709)
USER32.dll + 0x87eb (0x77cf87eb)
USER32.dll + 0x89a5 (0x77cf89a5)
USER32.dll + 0x89e8 (0x77cf89e8)
ConvertWtoA 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsToolkit.cpp,
line 196]
nsAutoCompleteController::RowIndexToSearch 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp,
line 1136]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x16d4f (0x7c816d4f)

Reproducible: Always

Steps to Reproduce:

Comment 1

[OstGote!]

see bug 281331 too

Comment 2

[Ryuichi KUBUKI]

Bug 281614 occurs at nsView::SetOpacity

Comment 3

[Boris Zbarsky [:bzbarsky]]

OK.  nsFrame::GetWindow doesn't call nsView::Paint (and never has, even before
it got changed 4 days ago).  So sounds like we just have a deleted frame or
something...

I'm going to request blocking just so this and the bugs it blocks stay on the
beta radar.

KL, any idea when this crash first appeared?

Comment 4

[Martijn Wargers (dead)]

I don't crash, using 20050203 7:56am Firefox trunk build.
I crash, using 20050204 7:14am Firefox trunk build.

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-03+07%3A00%3A00&maxdate=2005-02-04+08%3A00%3A00&cvsroot=%2Fcvsroot

Comment 5

[Martijn Wargers (dead)]

Backing out the first patch from bug 268352 ("Fix coordinate systems") and then
rebuilding layout/base and layout/build seems to fix this crash bug for me.

Comment 6

[Ryuichi KUBUKI]

(In reply to comment #3)
> KL, any idea when this crash first appeared?

As Martijn suggests, 1 week or so.
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=+nsView&vendor=All&product=FirefoxTrunk&platform=Win32&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
shows that this crash (TB 3515509) on 02-05 was the first I got in nsView.

Comment 7

[Boris Zbarsky [:bzbarsky]]

OK.  Sounds like work on bug 281424 (which has a reproducible testcase) ought to
fix this, then.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Should be fixed by the patch in bug 281424.  Please reopen if this is still an
issue in tomorrow's builds.