321016 - Lone <listboxbody/> crashes [@ nsListBoxBodyFrame::ComputeTotalRowCount]

Status: RESOLVED DUPLICATE of bug 358741

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Split from bug 320996 comment 2.  Crashes Firefox 1.5 (release) and trunk (debug) on Mac.

Thread 0 Crashed:

0   nsListBoxBodyFrame::ComputeTotalRowCount() + 84 (nsListBoxBodyFrame.cpp:831)
1   nsListBoxBodyFrame::GetRowCount() + 48 (nsListBoxBodyFrame.cpp:687)
2   nsListBoxLayout::GetPrefSize(nsIFrame*, nsBoxLayoutState&, nsSize&) + 120 (nsListBoxLayout.cpp:66)
3   nsBoxFrame::GetPrefSize(nsBoxLayoutState&, nsSize&) + 352 (nsBoxFrame.cpp:930)
4   nsListBoxBodyFrame::GetPrefSize(nsBoxLayoutState&, nsSize&) + 48 (nsListBoxBodyFrame.cpp:386)
5   nsXULScrollFrame::GetPrefSize(nsBoxLayoutState&, nsSize&) + 364 (nsGfxScrollFrame.cpp:1169)
6   nsSprocketLayout::PopulateBoxSizes(nsIFrame*, nsBoxLayoutState&, nsBoxSize*&, nsComputedBoxSize*&, int&, int&, int&) + 472 (nsSprocketLayout.cpp:822)
7   nsSprocketLayout::Layout(nsIFrame*, nsBoxLayoutState&) + 520 (nsSprocketLayout.cpp:265)
8   nsBoxFrame::DoLayout(nsBoxLayoutState&) + 148 (nsBoxFrame.cpp:1087)
9   nsIFrame::Layout(nsBoxLayoutState&) + 84 (nsBox.cpp:802)
10  nsStackLayout::Layout(nsIFrame*, nsBoxLayoutState&) + 660 (nsStackLayout.cpp:321)
11  nsBoxFrame::DoLayout(nsBoxLayoutState&) + 148 (nsBoxFrame.cpp:1087)
12  nsIFrame::Layout(nsBoxLayoutState&) + 84 (nsBox.cpp:802)
13  nsBoxFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) + 916 (nsBoxFrame.cpp:838)
14  nsRootBoxFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) + 100 (nsRootBoxFrame.cpp:214)
15  nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&) + 272 (nsContainerFrame.cpp:890)
16  ViewportFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) + 496 (nsViewportFrame.cpp:228)
17  PresShell::InitialReflow(int, int) + 1160 (nsPresShell.cpp:2767)
18  nsXULDocument::StartLayout() + 1076 (nsXULDocument.cpp:2104)
19  nsXULDocument::ResumeWalk() + 5336 (nsXULDocument.cpp:3138)
20  nsXULDocument::EndLoad() + 1548 (nsXULDocument.cpp:744)
21  XULContentSinkImpl::DidBuildModel() + 140 (nsXULContentSink.cpp:407)
22  nsExpatDriver::DidBuildModel(unsigned, int, nsIParser*, nsIContentSink*) + 108 (nsExpatDriver.cpp:1106)
...

Comment 1

[Jesse Ruderman]

Attachment: simple testcase

Comment 2

[Adam Guthrie]

(gdb) frame 6
#6  0xb50c28f9 in nsListBoxBodyFrame::ComputeTotalRowCount (this=0x88540c0) at /moz/trunk/mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp:831
831       PRUint32 childCount = listbox->GetChildCount();
(gdb) info locals
listbox = (nsIContent *) 0x0
childCount = 3216153228

Comment 3

[[e-mail]]

Since the listbox body frame makes assumptions about its content being anonymous perhaps it should only be created if its content is anonymous?

Comment 4

[Neil Deakin]

Bug 358741 looks to have fixed this.

Comment 5

[Jesse Ruderman]

Yep.  It has pretty much the same testcase, too.

*** This bug has been marked as a duplicate of 358741 ***