293651 - [FIXr]Crash [@ nsViewManager::UpdateWidgetsForView] aView = 0x0

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P2)

Description

[timeless]

Incident ID: 5326906 
Stack Signature nsViewManager::UpdateWidgetsForView 6985eea7 
Product ID MozillaTrunk 
Build ID 2005021712 
Trigger Time 2005-04-24 14:04:12.0 
Platform Win32 
Operating System Windows NT 5.1 build 2600 
Module gklayout.dll + (001501f0) 
URL visited https://www.netaddress.com/ 
User Comments Closing spell checker. 
Since Last Crash 273876 sec 
Total Uptime 1543918 sec 
Trigger Reason Access violation 
Source File, Line No. 
c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManage
r.cpp, line 3146 
Stack Trace  

nsViewManager::UpdateWidgetsForView  
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManag
er.cpp, line 3146]
PL_HandleEvent  
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/pleven
t.c, line 699]
0x778b0c24
0x006e006f

We also hit what I hope is the same thing internally (mozilla1.8a5):
>	gklayout.dll!nsViewManager::UpdateWidgetsForView(nsView * 
aView=0x00000000)  Line 3060 + 0x4	C++
 	gklayout.dll!nsViewManager::ForceUpdate()  Line 3448	C++
 	gklayout.dll!nsViewManager::Composite()  Line 1631	C++
 	gklayout.dll!nsViewManager::EnableRefresh(unsigned int aUpdateFlags=2)  
Line 3294	C++
 	gklayout.dll!nsViewManager::EndUpdateViewBatch(unsigned int 
aUpdateFlags=0)  Line 3343 + 0xa	C++
 	gklayout.dll!ReflowEvent::HandleEvent()  Line 6126	C++
 	xpcom_core.dll!PL_HandleEvent(PLEvent * self=0x07503160)  Line 693
	C

void nsViewManager::UpdateWidgetsForView(nsView* aView)
{
  NS_PRECONDITION(aView, "Must have view!");

  if (aView->HasWidget()) {

aView = 0x0

caller:
NS_IMETHODIMP nsViewManager::ForceUpdate()
{
  if (!IsRootVM()) {
    return RootViewManager()->ForceUpdate();
  }

  // Walk the view tree looking for widgets, and call Update() on each one
  UpdateWidgetsForView(mRootView);

mRootView = 0x0, mObserver = 0x0

bz confirms this should mean the window is closed

Comment 1

[timeless]

nsViewManager::Composite() checked mVMCount
mVMCount = 19
if it was 0, it wouldn't have gone through this hoop

there's a presshell in the reflowevent
mIsDestroying = 1, mHaveShutDown = 1

Comment 2

[Boris Zbarsky [:bzbarsky]]

Perhaps we should just bail out of reflow events immediately if mIsDestroying is
true?  Or not even post them after we've revoked events?  That would be even
better....

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: This might help

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 188121 [details] [diff] [review]
This might help

Requesting 1.8b3 approval.  This is a very safe fix that should help to prevent
some crashes by not reflowing while a presshell is being destroyed.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed