Closed
Bug 315193
Opened 19 years ago
Closed 19 years ago
access to deleted frame
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 315321
People
(Reporter: bernd_mozilla, Unassigned)
References
()
Details
currently layout regression tests are pretty short once I hit http://lxr.mozilla.org/mozilla/source/layout/html/tests/block/bugs/9100.html under windows the debug heap protection kicks in and thats it.
this looks very much like bug 315127
if (nsLayoutAtoms::directionalFrame == frameType) {
delete frame; <======
++lineOffset;
}
frame:
frame has 0 mContent, mStyleContext, mParent and mNextSibling so it looks like double deleting.
_free_dbg_lk(void * 0x02a41e28, int 1) line 1044 + 48 bytes
_free_dbg(void * 0x02a41e28, int 1) line 1001 + 13 bytes
free(void * 0x02a41e28) line 956 + 11 bytes
operator delete(void * 0x02a41e28) line 7 + 9 bytes
nsBidiPresUtils::Resolve(nsPresContext * 0x02983390, nsIFrame * 0x02a37058, nsIFrame * 0x02a370ac, int & 0, int 0) line 311 + 20 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x02a37058, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 788 + 139 bytes
nsBlockReflowContext::ReflowBlock(const nsRect & {...}, int 1, nsCollapsingMargin & {...}, int 0, int 0, nsMargin & {...}, nsHTMLReflowState & {...}, unsigned int & 0) line 605 + 51 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012d8b8) line 3455 + 64 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012d8b8, int 1) line 2617 + 23 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}, int 1) line 2269 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x02a364b4, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 902 + 17 bytes
nsBlockReflowContext::ReflowBlock(const nsRect & {...}, int 1, nsCollapsingMargin & {...}, int 0, int 1, nsMargin & {...}, nsHTMLReflowState & {...}, unsigned int & 0) line 605 + 51 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012e8c0) line 3455 + 64 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...}, int * 0x0012e8c0, int 1) line 2617 + 23 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}, int 1) line 2269 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x02a36330, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 902 + 17 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x02a36330, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 891 + 26 bytes
CanvasFrame::Reflow(CanvasFrame * const 0x02a2dbe0, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 525
nsContainerFrame::ReflowChild(nsIFrame * 0x02a2dbe0, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 3, unsigned int & 0) line 891 + 26 bytes
nsHTMLScrollFrame::ReflowScrolledFrame(const ScrollReflowState & {...}, int 0, int 1, nsHTMLReflowMetrics * 0x0012f300, int 1) line 513 + 91 bytes
nsHTMLScrollFrame::ReflowContents(ScrollReflowState * 0x0012f530, const nsHTMLReflowMetrics & {...}) line 583 + 25 bytes
nsHTMLScrollFrame::Reflow(nsHTMLScrollFrame * const 0x02a2dd2c, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 780 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x02a2dd2c, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0, int 0, unsigned int 0, unsigned int & 0) line 891 + 26 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x02a2db4c, nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 229 + 40 bytes
IncrementalReflow::Dispatch(nsPresContext * 0x02983390, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 857
PresShell::ProcessReflowCommands(int 1) line 6481
ReflowEvent::HandleEvent() line 6306
HandlePLEvent(ReflowEvent * 0x02a2ce40) line 6323
PL_HandleEvent(PLEvent * 0x02a2ce40) line 688 + 9 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00f10490) line 623 + 8 bytes
_md_EventReceiverProc(HWND__ * 0x00140492, unsigned int 49420, unsigned int 0, long 15795344) line 1408 + 8 bytes
USER32! 77d18734()
USER32! 77d18816()
USER32! 77d189cd()
USER32! 77d18a10()
nsAppShell::Run(nsAppShell * const 0x01788a88) line 135
nsAppStartup::Run(nsAppStartup * const 0x017889e8) line 161 + 77 bytes
XRE_main(int 4, char * * 0x003c6ee0, const nsXREAppData * 0x00421020 kAppData) line 2289 + 34 bytes
main(int 4, char * * 0x003c6ee0) line 61 + 16 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c816d4f()
*** This bug has been marked as a duplicate of 315321 ***
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Updated•6 years ago
|
Product: Core → Core Graveyard
Assignee | ||
Updated•6 years ago
|
Component: Layout: Misc Code → Layout
Product: Core Graveyard → Core
You need to log in
before you can comment on or make changes to this bug.
Description
•