Crash when drag-scrolling combobox [@ nsIFrame::HasView][@ nsIFrame::GetOffsetTo]

RESOLVED FIXED

Status

()

--
critical
RESOLVED FIXED
14 years ago
8 years ago

People

(Reporter: bugmail, Assigned: timeless)

Tracking

({crash})

Trunk
x86
All
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

14 years ago
Reproducible, using Gecko/20050721 Firefox/1.0+

steps to reproduce:

1: select 'philadelphia' from list of cities (go philly!)
2: allow map to load
3: click in city: box, and with left bouse button depressed, scroll up or down
to the upper/lower limit of the box
4: crash
(Reporter)

Comment 1

14 years ago
Related talkback IDs: TB7853215X, TB7853259Q
confirmed trunk fx gtk2 20050721. doesn't crash fx 1.0.6
Severity: major → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
OS: Windows 2000 → All
Summary: Crash when scrolling combobox → Crash when drag-scrolling combobox [@ nsIFrame::HasView]
Created attachment 190724 [details]
bt full

#4  <signal handler called>
#5  0xb4c356aa in nsIFrame::HasView (this=0x0) at nsIFrame.h:989
#6  0xb4cc4864 in nsIFrame::GetOffsetTo (this=0x0, aOther=0x89b6108)
#7  0xb4d7a019 in nsListControlFrame::GetIndexFromDOMEvent (this=0x89b6108,
(Assignee)

Comment 4

14 years ago
Incident ID: 7853215
Stack Signature	nsIFrame::GetOffsetTo 19705a27
Product ID	FirefoxTrunk
Build ID	2005072106
Trigger Time	2005-07-27 08:18:51.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (001990c8)
URL visited	http://housingmaps.com
User Comments	
Since Last Crash	327023 sec
Total Uptime	327023 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp,
line 2344
Stack Trace 	
nsIFrame::GetOffsetTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp,
line 2344]
nsListControlFrame::GetIndexFromDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsListControlFrame.cpp,
line 2655]
nsListControlFrame::MouseMove 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsListControlFrame.cpp,
line 2762]
nsListEventListener::MouseMove 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsListControlFrame.cpp,
line 3361]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1674]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2126]
nsHTMLSelectElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLSelectElement.cpp,
line 1772]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6357]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6193]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2547]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2234]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1171]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5814]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 6060]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1348]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
KERNEL32.DLL + 0x2893d (0x7c59893d)


5629 PresShell::GetPrimaryFrameFor(nsIContent* aContent,
5630                               nsIFrame**  aResult) const
5631 {
5632   *aResult = FrameManager()->GetPrimaryFrameFor(aContent);
5633   return NS_OK;
5634 }
the code that calls getprimaryframefor is broken
Summary: Crash when drag-scrolling combobox [@ nsIFrame::HasView] → Crash when drag-scrolling combobox [@ nsIFrame::HasView][@ nsIFrame::GetOffsetTo]
(Assignee)

Comment 5

14 years ago
Created attachment 190726 [details] [diff] [review]
handle null out from a function that always returns NS_OK
(Assignee)

Updated

14 years ago
Assignee: nobody → timeless
Status: NEW → ASSIGNED
Attachment #190726 - Flags: superreview?(roc)
Attachment #190726 - Flags: review?(roc)
Attachment #190726 - Flags: superreview?(roc)
Attachment #190726 - Flags: superreview+
Attachment #190726 - Flags: review?(roc)
Attachment #190726 - Flags: review+
(Assignee)

Updated

14 years ago
Attachment #190726 - Flags: approval1.8b4?

Updated

14 years ago
Attachment #190726 - Flags: approval1.8b4? → approval1.8b4+
(Assignee)

Comment 6

14 years ago
Comment on attachment 190726 [details] [diff] [review]
handle null out from a function that always returns NS_OK

mozilla/layout/forms/nsListControlFrame.cpp	1.372
Attachment #190726 - Attachment is obsolete: true
(Assignee)

Updated

14 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 14 years ago
Resolution: --- → FIXED

Comment 7

13 years ago
*** Bug 306105 has been marked as a duplicate of this bug. ***
Crash Signature: [@ nsIFrame::HasView] [@ nsIFrame::GetOffsetTo]
You need to log in before you can comment on or make changes to this bug.