If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash with CTRL+B & Manage Bookmarks [@ nsXULElement::GetAttrNameAt]

VERIFIED FIXED

Status

()

Core
DOM: Core & HTML
--
critical
VERIFIED FIXED
12 years ago
6 years ago

People

(Reporter: u88484, Assigned: sicking)

Tracking

({crash, regression})

Trunk
crash, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Reporter)

Description

12 years ago
Firefox crashes when CTRL+B is pressed to open the Bookmarks in the sidebar.

TB13378572Q

Stack Signature	 nsXULElement::GetAttrNameAt ec84f072
Product ID	FirefoxTrunk
Build ID	2005122905
Trigger Time	2005-12-29 08:16:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00192c83)
URL visited	
User Comments	
Since Last Crash	13 sec
Total Uptime	13 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1523
Stack Trace 	
nsXULElement::GetAttrNameAt  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1523]
nsXULTemplateBuilder::CompileSimpleRule  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 2186]
nsXULTemplateBuilder::CompileRules  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 1567]
nsXULTreeBuilder::RebuildAll  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 1343]
nsXULTemplateBuilder::Rebuild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 244]
nsXULTreeBuilder::SetTree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 835]
nsTreeBodyFrame::SetView  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 571]
nsTreeBodyFrame::EnsureView  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 461]
nsTreeBodyFrame::GetMinSize  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 261]
nsBox::GetPrefSize  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 703]
nsBox::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 781]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::Layout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 260]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1089]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1089]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 215]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 891]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 230]
PresShell::InitialReflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 2767]
nsXULDocument::StartLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2106]
nsXULDocument::ResumeWalk  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3146]
nsXULDocument::OnStreamComplete  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3430]
nsStreamLoader::OnStopRequest  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp, line 120]
nsJARChannel::OnStopRequest  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/modules/libjar/nsJARChannel.cpp, line 719]
(Reporter)

Updated

12 years ago
Version: unspecified → Trunk
(Reporter)

Comment 1

12 years ago
This regressed between yesterdays nightly and todays. 20051228->20051229
(Reporter)

Updated

12 years ago
Component: General → Bookmarks
Summary: Crash @ nsXULElement::GetAttrNameAt with CTRL+B → Crash @ nsXULElement::GetAttrNameAt with CTRL+B & Manage Bookmarks
Keywords: regression
A possible cause for the regression could be the checkin for bug 284950.
*** Bug 321812 has been marked as a duplicate of this bug. ***
Very likely a regression of bug 284950.
Assignee: nobody → general
Blocks: 284950
Component: Bookmarks → DOM: Core
Product: Firefox → Core
QA Contact: general → ian

Updated

12 years ago
Severity: major → critical
Keywords: crash
regressionwindow
works 20051228 0609pst
fails 20051228 1717pst

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&filetype=match&whotype=match&sortby=Date&hours=2&date=explicit&mindate=20051228+0500&maxdate=20051228+1700&cvsroot=%2Fcvsroot
Summary: Crash @ nsXULElement::GetAttrNameAt with CTRL+B & Manage Bookmarks → Crash with CTRL+B & Manage Bookmarks [@ nsXULElement::GetAttrNameAt]
Not a dupe/manifestation of bug 232639?
Seems like nsXULElement::GetAttrNameAt is not out-of-bounds safe, so this is sort of a manifestation of bug 232639 exposed by the patch in 284950.

Taking
Assignee: general → bugmail
Depends on: 232639

Comment 8

12 years ago
*** Bug 321844 has been marked as a duplicate of this bug. ***

Comment 9

12 years ago
SeaMonkey 1.5a build 1229210 on Mac OS X 10.3.9 also crashes when bookmarks opened in sidebar or from Manage Bookmarks  TB13397841G

Comment 10

12 years ago
Setting All/All as happens on Mac and Linux platforms too.
OS: Windows XP → All
Hardware: PC → All
*** Bug 321902 has been marked as a duplicate of this bug. ***
This should be fixed with the patch in bug 232639. Please reopen if that's not the case
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
*** Bug 321982 has been marked as a duplicate of this bug. ***

Comment 14

12 years ago
*** Bug 321993 has been marked as a duplicate of this bug. ***

Comment 15

12 years ago
*** Bug 322065 has been marked as a duplicate of this bug. ***
*** Bug 322125 has been marked as a duplicate of this bug. ***
Verified FIXED using both trunk SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Mozilla/1.0 and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Firefox/1.6a1
Status: RESOLVED → VERIFIED

Updated

9 years ago
Component: DOM: Core → DOM: Core & HTML
QA Contact: ian → general
Crash Signature: [@ nsXULElement::GetAttrNameAt]
You need to log in before you can comment on or make changes to this bug.