Closed Bug 315193 Opened 19 years ago Closed 19 years ago

access to deleted frame

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 315321

People

(Reporter: bernd_mozilla, Unassigned)

References

()

Details

currently layout regression tests are pretty short once I hit http://lxr.mozilla.org/mozilla/source/layout/html/tests/block/bugs/9100.html under windows the debug heap protection kicks in and thats it. this looks very much like bug 315127 if (nsLayoutAtoms::directionalFrame == frameType) { delete frame; <====== ++lineOffset; } frame: frame has 0 mContent, mStyleContext, mParent and mNextSibling so it looks like double deleting. _free_dbg_lk(void * 0x02a41e28, int 1) line 1044 + 48 bytes _free_dbg(void * 0x02a41e28, int 1) line 1001 + 13 bytes free(void * 0x02a41e28) line 956 + 11 bytes operator delete(void * 0x02a41e28) line 7 + 9 bytes nsBidiPresUtils::Resolve(nsPresContext * 0x02983390, nsIFrame * 0x02a37058, nsIFrame * 0x02a370ac, int & 0, int 0) line 311 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x02a37058, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 788 + 139 bytes nsBlockReflowContext::ReflowBlock(const nsRect & {...}, int 1, nsCollapsingMargin & {...}, int 0, int 0, nsMargin & {...}, nsHTMLReflowState & {...}, unsigned int & 0) line 605 + 51 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012d8b8) line 3455 + 64 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012d8b8, int 1) line 2617 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}, int 1) line 2269 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x02a364b4, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 902 + 17 bytes nsBlockReflowContext::ReflowBlock(const nsRect & {...}, int 1, nsCollapsingMargin & {...}, int 0, int 1, nsMargin & {...}, nsHTMLReflowState & {...}, unsigned int & 0) line 605 + 51 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012e8c0) line 3455 + 64 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012e8c0, int 1) line 2617 + 23 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}, int 1) line 2269 + 27 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x02a36330, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 902 + 17 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x02a36330, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 891 + 26 bytes CanvasFrame::Reflow(CanvasFrame * const 0x02a2dbe0, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 525 nsContainerFrame::ReflowChild(nsIFrame * 0x02a2dbe0, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 3, unsigned int & 0) line 891 + 26 bytes nsHTMLScrollFrame::ReflowScrolledFrame(const ScrollReflowState & {...}, int 0, int 1, nsHTMLReflowMetrics * 0x0012f300, int 1) line 513 + 91 bytes nsHTMLScrollFrame::ReflowContents(ScrollReflowState * 0x0012f530, const nsHTMLReflowMetrics & {...}) line 583 + 25 bytes nsHTMLScrollFrame::Reflow(nsHTMLScrollFrame * const 0x02a2dd2c, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 780 + 15 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x02a2dd2c, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 891 + 26 bytes ViewportFrame::Reflow(ViewportFrame * const 0x02a2db4c, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 229 + 40 bytes IncrementalReflow::Dispatch(nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 857 PresShell::ProcessReflowCommands(int 1) line 6481 ReflowEvent::HandleEvent() line 6306 HandlePLEvent(ReflowEvent * 0x02a2ce40) line 6323 PL_HandleEvent(PLEvent * 0x02a2ce40) line 688 + 9 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00f10490) line 623 + 8 bytes _md_EventReceiverProc(HWND__ * 0x00140492, unsigned int 49420, unsigned int 0, long 15795344) line 1408 + 8 bytes USER32! 77d18734() USER32! 77d18816() USER32! 77d189cd() USER32! 77d18a10() nsAppShell::Run(nsAppShell * const 0x01788a88) line 135 nsAppStartup::Run(nsAppStartup * const 0x017889e8) line 161 + 77 bytes XRE_main(int 4, char * * 0x003c6ee0, const nsXREAppData * 0x00421020 kAppData) line 2289 + 34 bytes main(int 4, char * * 0x003c6ee0) line 61 + 16 bytes mainCRTStartup() line 338 + 17 bytes KERNEL32! 7c816d4f()
Depends on: 315321
*** This bug has been marked as a duplicate of 315321 ***
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Product: Core → Core Graveyard
Component: Layout: Misc Code → Layout
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.