290419 - It crashes with shortcut of Shift + Tab - Trunk [@ nsFrameConstructorState::PushAbsoluteContainingBlock] [@ nsFrameConstructorState::AddChild]

Status: VERIFIED FIXED

(Firefox :: General, defect)

Description

[Hiro]

Incident ID:TB5098850E
In tinderbox-builds, it crashes by the short cut of Shift + Tab. 

Reproducible: Always

Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.8b2) Gecko/20050414
Firefox/1.0+


Stack Signature	 nsFrameConstructorState::PushAbsoluteContainingBlock 801d4a07
Product ID	FirefoxTrunk
Build ID	2005041406
Trigger Time	2005-04-14 18:50:58.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00165eb4)
URL visited	
User Comments	
Since Last Crash	3005 sec
Total Uptime	3005 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 1223
Stack Trace 	
nsFrameConstructorState::PushAbsoluteContainingBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 1223]
nsLeafIterator::Prev 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsFrameTraversal.cpp,
line 411]
nsEventStateManager::GenerateDragDropEnterExit 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2793]
nsEventStateManager::NotifyMouseOut 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2566]
nsEventStateManager::GenerateDragGesture 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 1499]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6223]
PresShell::RetargetEventToParent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5886]
ApplyZOrderStableSort 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1066]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2003]
ViewWrapper::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 88]
nsWindow::~nsWindow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 987]
nsWindow::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3366]
nsWindow::OnKeyDown 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3579]
nsWindow::EnableDragDrop 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3413]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4998]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1345]
USER32.dll + 0x86cb (0x77d486cb)
USER32.dll + 0x879f (0x77d4879f)
USER32.dll + 0x8a31 (0x77d48a31)
USER32.dll + 0x8ab4 (0x77d48ab4)
nsAppStartup::nsAppStartup 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 82]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x2141a (0x77e8141a)

Comment 1

[Adam Hauner]

Dupe of bug 290400 with different stack signature?

Comment 2

[Hiro]

In following build, there is no problem. 
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2005-04-14-07-trunk/firefox-1.0+.en-US.win32.zip

Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.8b2) Gecko/20050414
Firefox/1.0+

Comment 3

[Hermann Schwab]

tested using zip builds and testcase from bug 290400
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050412 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050413 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050413 Firefox/1.0+
BuildID 1.8b2: 2005041306
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050414 Firefox/1.0+
1.8b2: 2005041406

self-explaining testcase
https://bugzilla.mozilla.org/attachment.cgi?id=180756

Comment 4

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050415
Firefox/1.0+
Shift + Tab crashes for me.
TBID - TB5107580H

Comment 5

[Steve England [:stevee]]

*** Bug 290471 has been marked as a duplicate of this bug. ***

Comment 6

[Hermann Schwab]

crash  : 1.8b2: 2005041406 Tinderbox build, zip
working: 1.8b2: 2005041406 Nightly, zip (exe didn´t install) 

crashing:1.8b2: 2005041506 Nightly, exe + zip

Comment 7

[Hiro]

The Mac version reproduced. The Mac version reproduced. 

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; ja-JP; rv:1.8b2) Gecko/20050416
Firefox/1.0+

Comment 8

[Mike Pesce (:By-Tor)]

Reproduced on Linux build: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2)
Gecko/20050415 Firefox/1.0+

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

*** Bug 290545 has been marked as a duplicate of this bug. ***

Comment 10

[Boris Zbarsky [:bzbarsky]]

Please retest in tomorrow's (Saturday's) builds.  Fixing the crash regression in
bug 276954 should have fixed this.

Comment 11

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050416
Firefox/1.0+
Crashing has gone for me.

Comment 12

[bobgwsc]

Appears fixed in Mozilla 1.7.7... I love my shift-tabbing :)

Suggest mark as fixed

Comment 13

[Adam Hauner]

Marking FIXED by bug 276954.

Comment 14

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2005-04-18-05 on Windows XP Seamonkey trunk.

Comment 15

[Jay Patel [:jay]]

Adding another stack signature and topcrash keyword for future reference.  This
*was* a topcrasher on the Trunk, no crashes since the fix for bug 276954 went in.