It crashes with shortcut of Shift + Tab - Trunk [@ nsFrameConstructorState::PushAbsoluteContainingBlock] [@ nsFrameConstructorState::AddChild]

VERIFIED FIXED

Status

()

Firefox
General
--
critical
VERIFIED FIXED
13 years ago
7 years ago

People

(Reporter: Hiro, Assigned: Blake Ross)

Tracking

({crash, topcrash})

Trunk
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

13 years ago
Incident ID:TB5098850E
In tinderbox-builds, it crashes by the short cut of Shift + Tab. 

Reproducible: Always

Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.8b2) Gecko/20050414
Firefox/1.0+


Stack Signature	 nsFrameConstructorState::PushAbsoluteContainingBlock 801d4a07
Product ID	FirefoxTrunk
Build ID	2005041406
Trigger Time	2005-04-14 18:50:58.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00165eb4)
URL visited	
User Comments	
Since Last Crash	3005 sec
Total Uptime	3005 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 1223
Stack Trace 	
nsFrameConstructorState::PushAbsoluteContainingBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 1223]
nsLeafIterator::Prev 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsFrameTraversal.cpp,
line 411]
nsEventStateManager::GenerateDragDropEnterExit 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2793]
nsEventStateManager::NotifyMouseOut 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 2566]
nsEventStateManager::GenerateDragGesture 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventStateManager.cpp,
line 1499]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6223]
PresShell::RetargetEventToParent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5886]
ApplyZOrderStableSort 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 1066]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2003]
ViewWrapper::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line 88]
nsWindow::~nsWindow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 987]
nsWindow::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3366]
nsWindow::OnKeyDown 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3579]
nsWindow::EnableDragDrop 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 3413]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4998]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1345]
USER32.dll + 0x86cb (0x77d486cb)
USER32.dll + 0x879f (0x77d4879f)
USER32.dll + 0x8a31 (0x77d48a31)
USER32.dll + 0x8ab4 (0x77d48ab4)
nsAppStartup::nsAppStartup 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 82]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x2141a (0x77e8141a)
Keywords: crash
Summary: It crashes with short cut of Shift + Tab. → It crashes with short cut of Shift + Tab.

Comment 1

13 years ago
Dupe of bug 290400 with different stack signature?
Summary: It crashes with short cut of Shift + Tab. → It crashes with short cut of Shift + Tab [@ nsFrameConstructorState::PushAbsoluteContainingBlock ]
(Reporter)

Comment 2

13 years ago
In following build, there is no problem. 
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2005-04-14-07-trunk/firefox-1.0+.en-US.win32.zip

Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.8b2) Gecko/20050414
Firefox/1.0+

Comment 3

13 years ago
tested using zip builds and testcase from bug 290400
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050412 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050413 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050413 Firefox/1.0+
BuildID 1.8b2: 2005041306
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050414 Firefox/1.0+
1.8b2: 2005041406

self-explaining testcase
https://bugzilla.mozilla.org/attachment.cgi?id=180756
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050415
Firefox/1.0+
Shift + Tab crashes for me.
TBID - TB5107580H
*** Bug 290471 has been marked as a duplicate of this bug. ***

Comment 6

13 years ago
crash  : 1.8b2: 2005041406 Tinderbox build, zip
working: 1.8b2: 2005041406 Nightly, zip (exe didn´t install) 

crashing:1.8b2: 2005041506 Nightly, exe + zip
(Reporter)

Comment 7

13 years ago
The Mac version reproduced. The Mac version reproduced. 

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; ja-JP; rv:1.8b2) Gecko/20050416
Firefox/1.0+
OS: Windows XP → All
Hardware: PC → All

Comment 8

13 years ago
Reproduced on Linux build: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2)
Gecko/20050415 Firefox/1.0+
*** Bug 290545 has been marked as a duplicate of this bug. ***
Please retest in tomorrow's (Saturday's) builds.  Fixing the crash regression in
bug 276954 should have fixed this.
Depends on: 276954
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050416
Firefox/1.0+
Crashing has gone for me.

Comment 12

13 years ago
Appears fixed in Mozilla 1.7.7... I love my shift-tabbing :)

Suggest mark as fixed

Comment 13

13 years ago
Marking FIXED by bug 276954.
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED
Summary: It crashes with short cut of Shift + Tab [@ nsFrameConstructorState::PushAbsoluteContainingBlock ] → It crashes with shortcut of Shift + Tab [@ nsFrameConstructorState::PushAbsoluteContainingBlock ]
Verified FIXED using build 2005-04-18-05 on Windows XP Seamonkey trunk.
Status: RESOLVED → VERIFIED

Comment 15

13 years ago
Adding another stack signature and topcrash keyword for future reference.  This
*was* a topcrasher on the Trunk, no crashes since the fix for bug 276954 went in.
Keywords: topcrash
Summary: It crashes with shortcut of Shift + Tab [@ nsFrameConstructorState::PushAbsoluteContainingBlock ] → It crashes with shortcut of Shift + Tab - Trunk [@ nsFrameConstructorState::PushAbsoluteContainingBlock] [@ nsFrameConstructorState::AddChild]
Crash Signature: [@ nsFrameConstructorState::PushAbsoluteContainingBlock] [@ nsFrameConstructorState::AddChild]
You need to log in before you can comment on or make changes to this bug.