289123 - Crash with evil testcase (overflow:scroll;display:block;)

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Another crash testcase that isn't very simple, I'm afraid :(
Same regression date as bug 289032: works in 2005-04-03, crashes in 2005-04-04.
Possibly a regression from fixing bug 288117?

I could make the testcase more simple, but then it doesn't crash as often as it
does now. The testcase should crash relatively quickly (within 10s) or after a
few reloads.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Martijn Wargers (dead)]

Hmm, and now I have a hard time crashing the testcase at all :(

Comment 3

[Don Q]

Cannot reproduce on
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.6) Gecko/20050225
Firefox/1.0.1

Comment 4

[Anne (:annevk)]

Don Q, please read comment 0 carefully.

Comment 5

[Tobias Fischer]

I can reproduce this crash fine ;) with todays Nightly-Build: 
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050405 
{Build ID: 2005040506}

Add Talkback ID: TB4864241X
The Talkback-Server got an little delay today, feel free to add the stack, or I
will do this later when I awake. 

Comment 6

[Tobias Fischer]

O.K. the Stack from Talkback ID: 4864241

nsCOMPtr_base::assign_with_AddRef 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/build/nsCOMPtr.cpp,
line 89]
nsWindow::StandardWindowCreate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1507]
nsWindow::Create 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1672]
nsIView::CreateWidget 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 653]
nsScrollPortView::CreateScrollControls 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsScrollPortView.cpp,
line 157]
nsGfxScrollFrameInner::CreateScrollableView 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1138]
nsHTMLScrollFrame::SetInitialChildList 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 201]
nsCSSFrameConstructor::ConstructFrameByDisplayType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 6445]
nsCSSFrameConstructor::ConstructFrameInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7655]
nsCSSFrameConstructor::ConstructFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7485]
nsCSSFrameConstructor::ConstructTableForeignFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 3855]
nsCSSFrameConstructor::TableProcessChild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 4056]
nsCSSFrameConstructor::TableProcessChildren 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 3905]
nsCSSFrameConstructor::ConstructTableFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 3365]
nsCSSFrameConstructor::ConstructFrameByDisplayType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 6598]
nsCSSFrameConstructor::ConstructFrameInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7655]
nsCSSFrameConstructor::ConstructFrame 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 7485]
nsCSSFrameConstructor::ContentInserted 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9223]
nsCSSFrameConstructor::RecreateFramesForContent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 11606]
nsCSSFrameConstructor::RestyleElement 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 10183]
nsCSSFrameConstructor::ProcessOneRestyle 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 13555]
nsCSSFrameConstructor::ProcessPendingRestyles 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 13603]
nsCSSFrameConstructor::RestyleEvent::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 13656]
ntdll.dll + 0x30c24 (0x778b0c24)

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Likewise, this is triggering widget reparenting and probably will go away once
the patch for bug 288949 is checked in.

Comment 8

[Martijn Wargers (dead)]

Well, I haven't been able to crash with this in the 2005-04-08 build, so this
could be fixed by the fix for bug 288949.