284976 - Crash if XUL contains groupbox nested inside scrollbox [@ nsView::GetDimensions ]

Status: RESOLVED WONTFIX

(Core :: XUL, defect)

Description

[Chris Spencer]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

The following XUL causes Firefox to crash:

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<?xml-stylesheet href="style.css" type="text/css"?>
    
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

<scrollbox>
    <groupbox style='overflow: auto;'>
    </groupbox>
</scrollbox>

</window>

If you remove the stylesheet tags, Firefox simply hangs indefinitely. However,
it doesn't seem to matter what's in the stylesheet, as it hangs  even if the
stylesheet file is empty.


Reproducible: Always

Actual Results:  
F

Comment 1

[Adam Hauner]

TB4150335E:
nsView::GetDimensions 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsView.h,
line 248]
nsView::GetClippedRect 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp,
line 839]
nsViewManager::UpdateView 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1761]
nsViewManager::MoveViewTo 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2608]
nsContainerFrame::PositionFrameView 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 510]
nsContainerFrame::PositionChildViews 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 1020]
nsSprocketLayout::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 517]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsRootBoxFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp,
line 240]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
PresShell::InitialReflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 2804]
nsXULDocument::StartLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 2197]
nsXULDocument::ResumeWalk 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3050]
nsXULDocument::EndLoad 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 746]
XULContentSinkImpl::DidBuildModel 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULContentSink.cpp,
line 461

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: The testcase

Is this a problem with a current trunk build?  This testcase doesn't crash my
current nightly debug build...

Comment 3

[[e-mail]]

Nor mine.

Comment 4

[Nickolay_Ponomarev]

WFM too, Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2)
Gecko/20050307 Firefox/1.0+

Chris, if this crashes for you on latest trunk builds from
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/ please reopen.

Comment 5

[Adam Hauner]

Nickolay: This is bug on 1.7 branch, so I'm reopening.

Firefox 1.0.1/WXP is crashing -> TB4201867G
Suite 1.7.x/2005030707/WXP is crashing too -> TB4202082W
Both have same stack.

Comment 6

[Adam Hauner]

... and marking NEW.

Comment 7

[Boris Zbarsky [:bzbarsky]]

In that case, wontfix.  The sort of changes that have happened that fix this on
trunk are no good for the branch.