353008 - Crash [@ random] nsCommonWidget::DispatchEvent()

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Bob Clary [:bc] (inactive)]

unreduced testcase from bug 306940 crashes 1.8 but not trunk.

Linux TB23372130, TB23371774

0x0003fcf6
nsCommonWidget::DispatchEvent()  [mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219]
nsCommonWidget::OnDestroy()  [mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 264]
nsWindow::Destroy()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 842]
nsWindow::Destroy()  [mozilla/widget/src/gtk2/nsWindow.cpp, line 396]
nsView::~nsView()  [mozilla/view/src/nsView.cpp, line 267]
nsScrollPortView::~nsScrollPortView()  [mozilla/view/src/nsScrollPortView.cpp, line 90]
nsIView::Destroy()  [mozilla/view/src/nsView.cpp, line 304]
nsView::~nsView()  [mozilla/view/src/nsView.cpp, line 213]
nsIView::Destroy()  [mozilla/view/src/nsView.cpp, line 304]
nsFrame::Destroy()  [mozilla/layout/generic/nsFrame.cpp, line 656]
nsContainerFrame::Destroy()  [mozilla/layout/generic/nsContainerFrame.cpp, line 169]
nsFrameList::DestroyFrames()  [mozilla/layout/generic/nsFrameList.cpp, line 139]
nsBlockFrame::Destroy()  [mozilla/layout/generic/nsBlockFrame.cpp, line 296]
nsFrameList::DestroyFrames()  [mozilla/layout/generic/nsFrameList.cpp, line 139]
nsContainerFrame::Destroy()  [mozilla/layout/generic/nsContainerFrame.cpp, line 164]
nsFrameList::DestroyFrame()  [mozilla/layout/generic/nsFrameList.cpp, line 234]
...

On windows, this appears to be an infinite recursion crash dupe of?.

>	gklayout.dll!nsViewManager::IsRefreshEnabled()  Line 491	C++
 	gklayout.dll!nsViewManager::UpdateWidgetArea(nsView * aWidgetView=0x048d9530, const nsRegion & aDamagedRegion={...}, nsView * aIgnoreWidgetView=0x00000000)  Line 1749 + 0xb bytes	C++
 	gklayout.dll!nsViewManager::UpdateWidgetArea(nsView * aWidgetView=0x048b7330, const nsRegion & aDamagedRegion={...}, nsView * aIgnoreWidgetView=0x00000000)  Line 1818	C++
 	gklayout.dll!nsViewManager::UpdateWidgetArea(nsView * aWidgetView=0x048d9530, const nsRegion & aDamagedRegion={...}, nsView * aIgnoreWidgetView=0x00000000)  Line 1818	C++

Comment 1

[Jesse Ruderman]

On Mac (2.0.0.x nightly), I get the same "infinite recursion in nsViewManager::UpdateWidgetArea" crash that you get on Windows.

For the scarier Linux branch crash, a reduced testcase would be nice (assuming you can still reproduce it).  If you can't make a reduced testcase, I'm willing to make an exception to my "I don't care about branch" policy and try to get access to a Linux machine in order to make a reduced testcase.

Comment 2

[Bob Clary [:bc] (inactive)]

(In reply to comment #1)

Jesse, if you could look into this it would be nice. I am committed to other things at the moment. Do you still have access to pear?

Comment 3

[Lucas Adamski [:ladamski]]

I can't get this to repro on 2.0.0.17 or 3.0.3 on Linux, OS X or XP.  I ran it for quite a while.  If nobody else can either we should close this.

Comment 4

[Brandon Sterne (:bsterne)]

I can't reproduce on 2.0.0.17 either on any of the platforms.  Resolving WORKSFORME.  Per Jesse's comment, the testcase here was fuzzy (un-reduced) so it should remain hidden.