374090 - Crash [@ nsGfxScrollFrameInner::GetScrollPortSize] with noframes and setting binding on root element

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk builds on load.

Talkback ID: TB30264927H
0x46000000
nsGfxScrollFrameInner::GetScrollPortSize  [mozilla/layout/generic/nsgfxscrollframe.h, line 172]
nsGfxScrollFrameInner::FireScrollPortEvent  [mozilla/layout/generic/nsgfxscrollframe.cpp, line 1524]
nsGfxScrollFrameInner::AsyncScrollPortEvent::Run  [mozilla/layout/generic/nsgfxscrollframe.cpp, line 1895]
NS_ProcessNextEvent_P  [mozilla/xpcom/build/nsthreadutils.cpp, line 225]
nsBaseAppShell::Run  [mozilla/widget/src/xpwidgets/nsbaseappshell.cpp, line 153]

This regressed between 2007-03-04 and 2007-03-05, probably a regression from bug 363253.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: using weakFrame

Flushing kills the (outer) frame :(

(We should start thinking whether it is possible to remove some of the
 uses of WeakFrame)

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Btw, for some reason I see the crash only on non-debug-builds

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Why don't you just move the flush to AsyncScrollPortEvent.Run before you check mInner again?

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

That sounds better yes. Will make a new patch.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Except that I'd need to call mAsyncScrollPortEvent.Forget() before flushing, I think, and after that accessing mInner may not be safe.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(In reply to comment #5)
> Except that I'd need to call mAsyncScrollPortEvent.Forget() before flushing, I
> think

why?

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Attachment: move the flush to ::Run

Comment 8

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6d6bc4931a37

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6d6bc4931a37