Last Comment Bug 313173 - Crash with evil xul testcase, using table-caption/-moz-grid [@ nsGridRow::IsCollapsed][@ nsGrid::GetScrollBox]
: Crash with evil xul testcase, using table-caption/-moz-grid [@ nsGridRow::IsC...
Status: VERIFIED FIXED
[sg:critical?]
: crash, fixed1.7.13, testcase, verified1.8
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: All All
: P1 critical (vote)
: mozilla1.8rc1
Assigned To: Boris Zbarsky [:bz]
:
Mentors:
Depends on:
Blocks: 312784
  Show dependency treegraph
 
Reported: 2005-10-20 11:18 PDT by Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( )
Modified: 2011-06-13 10:01 PDT (History)
9 users (show)
dveditz: blocking1.7.13+
dveditz: blocking‑aviary1.0.8+
asa: blocking1.8rc1+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (776 bytes, application/vnd.mozilla.xul+xml)
2005-10-20 11:19 PDT, Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( )
no flags Details
Proposed patch (3.39 KB, patch)
2005-10-20 15:55 PDT, Boris Zbarsky [:bz]
neil: review+
roc: superreview+
dveditz: approval‑aviary1.0.8+
dveditz: approval1.7.13+
asa: approval1.8rc1+
Details | Diff | Review

Description Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( ) 2005-10-20 11:18:36 PDT
The upcoming testcase crashes Mozilla when clicking on the button.

Talkback ID: TB10392796Y
(can't see the tb id right now, but iirc, I once got appr. the same stack as the
one from bug 311710, so marking as a security bug for now)

nsGrid::GetScrollBox 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 1493]
nsGridRowLayout::GetParentGridPart 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLayout.cpp,
line 91]
nsGridRowLayout::GetGrid 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLayout.cpp,
line 176]
nsGridRowLayout::GetGrid 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLayout.cpp,
line 179]
nsGridRowLayout::GetGrid 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLayout.cpp,
line 124]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 85]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
nsGrid::GetPrefRowSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 589]
nsGridRowLeafLayout::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp,
line 92]
nsBoxFrame::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 948]
nsGridCell::GetPrefSize 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridCell.cpp,
line 84]
nsGrid::GetPrefRowHeight 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp,
line 986]
Comment 1 Martijn Wargers [:mwargers] (gone per 2016-05-31 :-( ) 2005-10-20 11:19:48 PDT
Created attachment 200245 [details]
testcase
Comment 2 Boris Zbarsky [:bz] 2005-10-20 12:16:39 PDT
Yep.  Calling methods on a deleted box... :(  Gotta love grids.  :(  Is there
any way we can disable them for this release?  Or are they too widely used?
Comment 3 neil@parkwaycc.co.uk 2005-10-20 13:40:50 PDT
So the issue is that a GridRowLayout has a ChildrenRemoved override but a
GridLayout2 does not?
Comment 4 Boris Zbarsky [:bz] 2005-10-20 15:52:34 PDT
Hmm.. Yeah, that seems to be it.  The same issue in bug 312784, in fact.
Comment 5 Boris Zbarsky [:bz] 2005-10-20 15:55:14 PDT
Created attachment 200288 [details] [diff] [review]
Proposed patch

This fixes this bug and bug 312784.  We still assert in
nsGrid::GetMin/Pref/MaxRowSize because we have no columns and someone passes a
column index of 0, but the code there also bails out safely in addition to
asserting, so we're sorta ok.
Comment 6 Boris Zbarsky [:bz] 2005-10-21 08:08:33 PDT
Comment on attachment 200288 [details] [diff] [review]
Proposed patch

I think we should just get this in on trunk so we can verify and maybe get this
on branch in time for freeze.  I talked to Neil on IRC and he seemed happy with
the patch; I assume he'll mark review once he wakes up...
Comment 7 neil@parkwaycc.co.uk 2005-10-21 09:37:49 PDT
Comment on attachment 200288 [details] [diff] [review]
Proposed patch

Are the assertions in nsGrid.cpp "normal"? I also wonder whether the
mMarkingDirty member is relevant to the rebuild.
Comment 8 Boris Zbarsky [:bz] 2005-10-21 10:26:05 PDT
> Are the assertions in nsGrid.cpp "normal"?

No; I will file a followup bug on them.

Comment 9 Asa Dotzler [:asa] 2005-10-21 11:34:55 PDT
Comment on attachment 200288 [details] [diff] [review]
Proposed patch

Please land on the trunk, ASAP. We'll evaluate it for the branch once it's been
landed and verified on the trunk. Thanks.
Comment 10 Boris Zbarsky [:bz] 2005-10-21 11:54:31 PDT
Fixed on trunk a few hours ago.
Comment 11 Boris Zbarsky [:bz] 2005-10-21 11:58:48 PDT
Filed bug 313303 on the assert.
Comment 12 Daniel Veditz [:dveditz] 2005-10-21 14:01:58 PDT
This is potentially exploitable
Comment 13 Scott MacGregor 2005-10-21 15:36:03 PDT
jesse, care to do an hourly build based verification on the trunk for this bug? 
Comment 14 Jesse Ruderman 2005-10-21 16:01:31 PDT
The atlantia tinderbox is on fire, so I can't get an hourly build, but I'll test
with my own debug build in a bit.
Comment 15 Jesse Ruderman 2005-10-21 17:08:23 PDT
WFM with the Mac build from
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2005-10-21-15-trunk/.  I
was able to reproduce this crash in a build from yesterday (before the patch
went in).  I'm not sure I should mark this bug as verified, because Martijn
originally reported this bug on Windows.
Comment 16 Asa Dotzler [:asa] 2005-10-21 17:31:59 PDT
OK. I've verified that the testcase does crash me with yesterday's build and
does not crash me with the latest hourly build on windows. 
Comment 17 Boris Zbarsky [:bz] 2005-10-21 17:41:35 PDT
Fixed on branch.
Comment 18 Bob Clary [:bc:] 2005-11-09 20:21:58 PST
no crash firefox 1.5 rc2 winxp/linux
Comment 19 Daniel Veditz [:dveditz] 2006-02-06 12:42:39 PST
Comment on attachment 200288 [details] [diff] [review]
Proposed patch

aviary101/moz17 landing approval: a=dveditz for drivers. Please add the fixed1.7.13 and fixed-aviary1.0.8 keywords when landed.
Comment 20 Boris Zbarsky [:bz] 2006-02-06 13:34:46 PST
Fixed on 1.7 and aviary 1.0.x branches.
Comment 21 Jay Patel [:jay] 2006-02-09 14:58:15 PST
The testcase is still crashing for me with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20060209 Firefox/1.0.7.  Will post my Talkback stack once it's processed to see if we're crashing somewhere else now.   

Can anyone else confirm this is still a problem on the Aviary branch, even with the checkin from 2/6?
Comment 22 Boris Zbarsky [:bz] 2006-02-10 21:47:11 PST
Jay, this worksforme with my aviary branch build.... Did that talkback ID ever materialize?
Comment 23 Jay Patel [:jay] 2006-02-11 03:06:14 PST
Here's my recent Aviary crash (looks similar):
Incident ID: 14972347
Stack Signature	nsGrid::GetScrollBox f0a28047
Email Address	jay@mozilla.org
Product ID	Firefox10
Build ID	2006020905
Trigger Time	2006-02-09 14:50:09.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (002d9c14)
URL visited	https://bugzilla.mozilla.org/show_bug.cgi?id=313173
User Comments	crash with evil xul testcae with 1.0.8 .. might not be the same bug, but still a problem.
Since Last Crash	547 sec
Total Uptime	547 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 1489
Stack Trace 	
nsGrid::GetScrollBox  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGrid.cpp, line 1489]
nsGridRowLeafLayout::ComputeChildSizes  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp, line 321]
nsSprocketLayout::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 285]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsLineLayout.cpp, line 993]
nsBlockFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3748]
nsBlockFrame::DoReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3446]
nsBlockFrame::DoReflowInlineFramesAuto  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3347]
nsBlockFrame::ReflowInlineFrames  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3292]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2456]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 2098]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 817]
nsTableOuterFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/table/src/nsTableOuterFrame.cpp, line 1974]
nsBoxToBlockAdaptor::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 884]
nsBoxToBlockAdaptor::RefreshSizeCache  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 385]
nsBoxToBlockAdaptor::GetAscent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxToBlockAdaptor.cpp, line 590]
nsStackLayout::GetAscent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsStackLayout.cpp, line 178]
nsContainerBox::GetAscent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 595]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 955]
nsContainerBox::GetAscent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 595]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 955]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsContainerBox::DoLayout  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsContainerBox.cpp, line 610]
nsBox::Layout  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 1016]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 240]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsContainerFrame.cpp, line 982]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsViewportFrame.cpp, line 249]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 904]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6401]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/html/base/src/nsPresShell.cpp, line 6226]
PL_HandleEvent  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/xpcom/threads/plevent.c, line 674]
0x778b0c24
PreferredFontEnumCallback  [c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/mathml/base/src/nsMathMLChar.cpp, line 983]
0xc03302eb
Comment 24 Boris Zbarsky [:bz] 2006-02-11 12:41:59 PST
Hmm... That crashes in a different place, but _possibly_ related.  Is it reliably reproducible?
Comment 25 Jay Patel [:jay] 2006-02-13 11:17:46 PST
bz:  I just crashed again with today's 1.0.8 build using the testcase in this bug, so it appears to be easily reproducible.  Let me know if we need to reopen this bug or log a new one.
Comment 26 Boris Zbarsky [:bz] 2006-02-13 11:23:19 PST
New one, I guess?  And note that "easily" and "reliably" are not the same thing.  "easily" would be "crashes once out of every three loads or so" while "reliably" is crashes every load.  Which one is it?
Comment 27 Jay Patel [:jay] 2006-02-13 12:57:22 PST
bz:  It is reliably reproducible for me... I have crashed 4 out of 4 times on loading the testcase with 2 recent builds.  Are you able to reproduce?  I will log a bug as soon as my most recent crash is processed and I can confirm the stack is the same as the one I posted.
Comment 28 Tracy Walker [:tracy] 2006-02-14 13:22:40 PST
jay, did you file a new bug?
I reliably crash on windows, mac and linux:
Windows:
Moz - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060214
Fx - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060214
Firefox/1.0.8
Macintosh:
Moz - Mozilla/5.0 (Macintosh; U;PPC Mac OS X Mach-O; en-US; rv:1.7.13)
Gecko/20060214 Firefox/1.0.8
Fx - Mozilla/5.0 (Macintosh; U;PPC Mac OS X Mach-O; en-US; rv:1.7.13)
Gecko/20060214 Firefox/1.0.8
Linux
Moz - Mozilla/5.0 (X11; U;Linux i686; en-US; rv:1.7.13) Gecko/20060214
Fx -  Mozilla/5.0 (X11; U;Linux i686; en-US; rv:1.7.13) Gecko/20060214
Firefox/1.0.8
Comment 29 Boris Zbarsky [:bz] 2006-02-14 14:32:22 PST
So I finally managed to reproduce Jay's crash.  That's bug 275896 (landed on trunk about a year ago, so it's in 1.8, but it never made it to 1.7).

Not sure whether we care for 1.7, since it's a null pointer dereference, not a deleted pointer dereference...
Comment 30 Jay Patel [:jay] 2006-02-15 13:31:19 PST
Tracy: Nope,  haven't logged a bug yet, but looks like bz found an existing one.  I'll leave it up to the devs to decide what needs to be done about that one.  

I'm just going to mark this verified on 1.0.8 since my crash is different than the one that was fixed here.  I'll nominate bug 275896 for 1.0.9 in case we want to take the null pointer checks for the next release.

Thanks bz for digging that bug up.

Comment 31 Bob Clary [:bc:] 2009-04-24 11:26:28 PDT
crash test landed
http://hg.mozilla.org/mozilla-central/rev/811d3a773dc0

Note You need to log in before you can comment on or make changes to this bug.