289410 - Correct xul code involving scrollbox make firefox crash [@ nsView::GetDimensions ]

Status: VERIFIED WORKSFORME

(Core :: Web Painting, defect)

Description

[Stelian Pop]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050323 Firefox/1.0.2 Fedora/1.0.2-1.3.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050323 Firefox/1.0.2 Fedora/1.0.2-1.3.1

When loading the attached xul code, firefox crashes. Replacing the scrollbox
with a hbox makes the problem go away

Reproducible: Always

Steps to Reproduce:
1. Load the attached xul code
2.
3.

Actual Results:  
Firefox crashed

Expected Results:  
Display the xul UI

Comment 1

[Stelian Pop]

Attachment: XUL code making Firefox crash

Comment 2

[Tuukka Tolvanen (sp3000)]

crashes linux fx 1.0.2, worksforme trunk 20050405

Comment 3

[José Jeria]

WFM: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050407
Firefox/1.0+

Crashes with 1.0.x

Comment 4

[Adam Hauner]

Incident ID: 4910548
Stack Signature	nsView::GetDimensions 6a0bf86e
Product ID	Firefox10
Build ID	2005031717
Trigger Time	2005-04-07 06:32:05.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001e1224)
URL visited	https://bugzilla.mozilla.org/attachment.cgi?id=179938
User Comments	bug 289410
Since Last Crash	7 sec
Total Uptime	1588 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsView.h,
line 248

Stack Trace 	
nsView::GetDimensions 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsView.h,
line 248]
nsView::GetClippedRect 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp,
line 839]
nsViewManager::UpdateView 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1761]
nsViewManager::MoveViewTo 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2608]
nsContainerFrame::PositionFrameView 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 510]
nsContainerFrame::PositionChildViews 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 1020]
nsSprocketLayout::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp,
line 517]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsContainerBox::DoLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp,
line 610]
nsBox::Layout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 1016]
nsRootBoxFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp,
line 240]
nsContainerFrame::ReflowChild 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp,
line 982]
ViewportFrame::Reflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp,
line 249]
PresShell::InitialReflow 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 2804]
nsXULDocument::StartLayout 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 2197]
nsXULDocument::ResumeWalk 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 3050]
nsXULDocument::EndLoad 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 746]
XULContentSinkImpl::DidBuildModel 
[d:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.0_Depend/mozilla/content/xul/document/src/nsXULContentSink.cpp,
line 461]

-> Core / Layout: View Rendering

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This bug should not be open; it was fixed on trunk a long time ago.

Comment 6

[Hermann Schwab]

crashing on 1.7.7 Release Candidate:
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.7) Gecko/20050406
TB4918319X
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4918319X

Comment 7

[Tuukka Tolvanen (sp3000)]

v per bug 284976 comment 7

Comment 8

[Bob Clary [:bc] (inactive)]

layout/xul/base/src/crashtests/289410-1.xul
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3