Last Comment Bug 321224 - crash with nativescrollbar inside tabpanels [@ nsView::SetTopMost] [@ HandleEvent] [@ nsViewManager::UpdateWidgetArea]
: crash with nativescrollbar inside tabpanels [@ nsView::SetTopMost] [@ HandleE...
Status: RESOLVED FIXED
[sg:critical] using freed view; fixed...
: crash, testcase, verified1.8.0.13, verified1.8.1.5
Product: Core
Classification: Components
Component: XUL (show other bugs)
: 1.8 Branch
: All All
: -- critical (vote)
: ---
Assigned To: Mats Palmgren (:mats)
:
Mentors:
Depends on: 374102
Blocks: 320996
  Show dependency treegraph
 
Reported: 2005-12-22 06:50 PST by Bernd
Modified: 2013-01-26 16:51 PST (History)
15 users (show)
dveditz: blocking1.8.1.5+
dveditz: wanted1.8.1.x+
dveditz: blocking1.8.0.13+
dveditz: wanted1.8.0.x+
mats: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase crash onload or reload (165 bytes, text/xml)
2005-12-22 06:51 PST, Bernd
no flags Details

Description Bernd 2005-12-22 06:50:37 PST
see upcoming testcase
crashes Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051221 Firefox/1.6a1
but I dont get a nice stacktrace in a debug build, if it does not crash immeadetely reload does fix it. The load triggers:
###!!! ASSERTION: We already have a window for this view? BAD: '!mWindow', file
d:/moz_src/mozilla/view/src/nsView.cpp, line 657
Comment 1 Bernd 2005-12-22 06:51:17 PST
Created attachment 206596 [details]
testcase crash onload or reload
Comment 2 Ria Klaassen (not reading all bugmail) 2005-12-22 08:12:51 PST
It crashes also 1.0.7 and branch, always after closing the browser. Currently problems with the talkback server.
Comment 3 Bernd 2005-12-22 09:31:49 PST
<deck><nativescrollbar/></deck> is equally efficient
Comment 4 Bernd 2005-12-22 09:49:31 PST
nativescrollbars seem to be implemented only on MAC
Comment 5 Eric Foley 2005-12-22 12:29:21 PST
Can confirm on Windows XP Home, Firefox 1.5 Final
Comment 6 Hermann Schwab 2005-12-23 01:40:16 PST
TB13192392H, TB13192279G

HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 173]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1162]
nsWindow::DispatchStandardEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1202]
nsWindow::OnDestroy  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 5652]
ChildWindow::`vftable'
nsWindow::StandardWindowCreate  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1399]
Comment 7 Peter van der Woude [:Peter6] 2005-12-23 16:21:11 PST
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20051223 Firefox/1.6a1 ID:2005122313

Incident ID: 13216053
Stack Signature	nsView::SetTopMost 6393c0f1
Product ID	FirefoxTrunk
Build ID	2005122305
Trigger Time	2005-12-23 16:17:30.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	FIREFOX.EXE + (00234478)
URL visited	https://bugzilla.mozilla.org/attachment.cgi?id=206596
User Comments	
Since Last Crash	11193 sec
Total Uptime	11193 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.h, line 281
Stack Trace 	
nsView::SetTopMost  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/view/src/nsView.h, line 281]
nsWindow::DispatchAppCommandEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1214]
nsWindow::CaptureRollupEvents  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1236]
nsWindow::OnPaint  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 5743]
ChildWindow::`vftable'
nsWindow::StandardWindowCreate  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1449]
0x8bf63356
Comment 8 Jesse Ruderman 2006-06-03 10:57:43 PDT
Still crashes on Windows.  TB19459617X just has nsViewManager::UpdateWidgetArea, no rest-of-the-stack.
Comment 9 Jesse Ruderman 2006-06-03 10:59:46 PDT
No crash with a Mac trunk nightly.
Comment 10 Jesse Ruderman 2006-06-03 11:04:01 PDT
With a Mac trunk debug build, I don't see a crash, but I do see the assertion from comment 0:

###!!! ASSERTION: We already have a window for this view? BAD: '!mWindow', file /Users/admin/trunk/mozilla/view/src/nsView.cpp, line 621
Comment 11 Mats Palmgren (:mats) 2007-05-08 16:41:30 PDT
Based on the assertion I think this is the same underlying cause as
bug 374102.  The patches on that bug made the crash go away for the
attached testcase.  Haven't really analyzed this crash though.
Comment 12 Jesse Ruderman 2007-05-08 17:22:46 PDT
xul:nativescrollbar is gone now, isn't it?
Comment 13 Mats Palmgren (:mats) 2007-05-13 18:47:41 PDT
(In reply to comment #12)
> xul:nativescrollbar is gone now, isn't it?

Yes, on trunk.  Branches still crash, using freed memory.
I'm pretty sure it's the same underlying cause as bug 374102 - 
a branch version of those patches fixes this crash.
Comment 14 Martijn Wargers [:mwargers] (not working for Mozilla) 2007-05-14 08:25:26 PDT
This doesn't crash anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070514 Minefield/3.0a5pre
So I'm marking this fixed (by the patch from bug 374102).
Comment 15 Mats Palmgren (:mats) 2007-07-01 16:07:24 PDT
Now also fixed on branches, by bug 374102.
Comment 16 Carsten Book [:Tomcat] - PTO-back Sept 4th 2007-07-04 21:04:02 PDT
verified fixed 1.8.1.5 using Mozilla/5.0
(X11; U; Linux i686; en-US; rv:1.8.1.5pre) Gecko/2007070403 BonEcho/2.0.0.5pre
on Linux Fedora F7 and Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre ID:2007070403 - no crash on testcase - adding verified keyword.
Comment 17 Hermann Schwab 2007-07-05 12:22:31 PDT
verified fixed
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1.5pre) Gecko/20070704 BonEcho/2.0.0.5pre

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.13pre) Gecko/20070703 SeaMonkey/1.0.9
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1.5pre) Gecko/20070703 SeaMonkey/1.1.2
Comment 18 juan becerra [:juanb] 2007-08-17 17:42:38 PDT
Verified fixed in Thunderbird(rc1) version 1.5.0.13 (20070809) in MacIntel using the testcase in comment#1. No crash observed. 
Comment 19 Bob Clary [:bc:] 2009-03-31 15:20:59 PDT
mats, if nativescrollbar is gone on 1.9.0 and later is there point in adding a crash test?
Comment 20 Mats Palmgren (:mats) 2013-01-25 09:38:05 PST
Added crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3f5d453c4a28
Comment 21 Ryan VanderMeulen [:RyanVM] 2013-01-26 16:51:16 PST
https://hg.mozilla.org/mozilla-central/rev/3f5d453c4a28

Note You need to log in before you can comment on or make changes to this bug.