302356 - Crash when drag-scrolling combobox [@ nsIFrame::HasView][@ nsIFrame::GetOffsetTo]

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect)

Description

[MightyMu]

Reproducible, using Gecko/20050721 Firefox/1.0+

steps to reproduce:

1: select 'philadelphia' from list of cities (go philly!)
2: allow map to load
3: click in city: box, and with left bouse button depressed, scroll up or down
to the upper/lower limit of the box
4: crash

Comment 1

[MightyMu]

Related talkback IDs: TB7853215X, TB7853259Q

Comment 2

[Tuukka Tolvanen (sp3000)]

confirmed trunk fx gtk2 20050721. doesn't crash fx 1.0.6

Comment 3

[Tuukka Tolvanen (sp3000)]

Attachment: bt full

#4  <signal handler called>
#5  0xb4c356aa in nsIFrame::HasView (this=0x0) at nsIFrame.h:989
#6  0xb4cc4864 in nsIFrame::GetOffsetTo (this=0x0, aOther=0x89b6108)
#7  0xb4d7a019 in nsListControlFrame::GetIndexFromDOMEvent (this=0x89b6108,

Comment 4

[timeless]

Incident ID: 7853215
Stack Signature	nsIFrame::GetOffsetTo 19705a27
Product ID	FirefoxTrunk
Build ID	2005072106
Trigger Time	2005-07-27 08:18:51.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (001990c8)
URL visited	http://housingmaps.com
User Comments	
Since Last Crash	327023 sec
Total Uptime	327023 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp,
line 2344
Stack Trace 	
nsIFrame::GetOffsetTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp,
line 2344]
nsListControlFrame::GetIndexFromDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsListControlFrame.cpp,
line 2655]
nsListControlFrame::MouseMove 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsListControlFrame.cpp,
line 2762]
nsListEventListener::MouseMove 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/forms/nsListControlFrame.cpp,
line 3361]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1674]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2126]
nsHTMLSelectElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/content/src/nsHTMLSelectElement.cpp,
line 1772]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2222]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6357]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6193]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2547]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp,
line 2234]
HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1171]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5814]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 6060]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1348]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 146]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
KERNEL32.DLL + 0x2893d (0x7c59893d)


5629 PresShell::GetPrimaryFrameFor(nsIContent* aContent,
5630                               nsIFrame**  aResult) const
5631 {
5632   *aResult = FrameManager()->GetPrimaryFrameFor(aContent);
5633   return NS_OK;
5634 }
the code that calls getprimaryframefor is broken

Comment 5

[timeless]

Attachment: handle null out from a function that always returns NS_OK

Comment 6

[timeless]

Comment on attachment 190726 [details] [diff] [review]
handle null out from a function that always returns NS_OK

mozilla/layout/forms/nsListControlFrame.cpp	1.372

Comment 7

[Adam Guthrie]

*** Bug 306105 has been marked as a duplicate of this bug. ***