382507 - Crash [@ nsThebesDeviceContext::FindScreen]

Status: RESOLVED INCOMPLETE

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

I think this crash occurred on a page where frames (in a frameset) were being created and destroyed frantically.  I don't have a testcase or steps to reproduce :(  I was using a Mac trunk debug build.

bz, can you figure out what's wrong based on the stack?  If not, you can mark this bug as INCOMPLETE.


Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xc9046311

Thread 0 Crashed:
0   libobjc.A.dylib          	0x90a57580 _class_lookupMethodAndLoadCache + 72
1   libobjc.A.dylib          	0x90a57506 objc_msgSend + 86
2   libgkgfxthebes.dylib     	0x2eb10b74 nsThebesDeviceContext::FindScreen(nsIScreen**) + 62 (nsThebesDeviceContext.cpp:670)
3   libgkgfxthebes.dylib     	0x2eb110f0 nsThebesDeviceContext::ComputeFullAreaUsingScreen(nsRect*) + 64 (nsThebesDeviceContext.cpp:643)
4   libgkgfxthebes.dylib     	0x2eb11250 nsThebesDeviceContext::GetRect(nsRect&) + 92 (nsThebesDeviceContext.cpp:482)
5   libgklayout.dylib        	0x17f847a4 nsScreen::GetRect(nsRect&) + 60 (nsScreen.cpp:245)
6   libgklayout.dylib        	0x17f84870 nsScreen::GetWidth(int*) + 36 (nsScreen.cpp:112)
7   libxpcom_core.dylib      	0x0136956a NS_InvokeByIndex_P + 98 (xptcinvoke_unixish_x86.cpp:179)
8   libxpconnect.dylib       	0x02a426d0 XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) + 4832 (xpcwrappednative.cpp:2229)
9   libxpconnect.dylib       	0x02a776a7 XPCWrappedNative::GetAttribute(XPCCallContext&) + 25 (xpcwrappednativejsops.cpp:2021)
10  libxpconnect.dylib       	0x02a4a397 XPC_WN_GetterSetter(JSContext*, JSObject*, unsigned, long*, long*) + 523 (xpcwrappednativejsops.cpp:1499)
11  libmozjs.dylib           	0x0105e9a7 js_Invoke + 3275 (jsinterp.c:1332)
12  libmozjs.dylib           	0x0105edc8 js_InternalInvoke + 309 (jsinterp.c:1426)
13  libmozjs.dylib           	0x0105f022 js_InternalGetOrSet + 401 (jsinterp.c:1498)
14  libmozjs.dylib           	0x0108ce1c js_NativeGet + 621 (jsobj.c:3472)
15  libmozjs.dylib           	0x0108d98d js_GetProperty + 985 (jsobj.c:3615)
16  libmozjs.dylib           	0x0106e5fe js_Interpret + 58195 (jsinterp.c:3783)
17  libmozjs.dylib           	0x0105f3a3 js_Execute + 885 (jsinterp.c:1591)
18  libmozjs.dylib           	0x0101d82c JS_EvaluateUCScriptForPrincipals + 158 (jsapi.c:4801)
19  libgklayout.dylib        	0x17f54a6c nsJSContext::EvaluateString(nsAString_internal const&, void*, nsIPrincipal*, char const*, unsigned, unsigned, nsAString_internal*, int*) + 1004 (nsJSEnvironment.cpp:1380)
20  libgklayout.dylib        	0x17df362c nsScriptLoader::EvaluateScript(nsScriptLoadRequest*, nsString const&) + 806 (nsScriptLoader.cpp:607)
21  libgklayout.dylib        	0x17df38ca nsScriptLoader::ProcessRequest(nsScriptLoadRequest*) + 248 (nsScriptLoader.cpp:521)
22  libgklayout.dylib        	0x17df4c19 nsScriptLoader::ProcessScriptElement(nsIScriptElement*) + 4459 (nsScriptLoader.cpp:486)
23  libgklayout.dylib        	0x17df0f94 nsScriptElement::MaybeProcessScript() + 382 (nsScriptElement.cpp:201)
24  libgklayout.dylib        	0x17e6c12e nsHTMLScriptElement::MaybeProcessScript() + 30 (nsHTMLScriptElement.cpp:534)
25  libgklayout.dylib        	0x17e6b6d5 nsHTMLScriptElement::DoneAddingChildren(int) + 33 (nsHTMLScriptElement.cpp:481)
26  libgklayout.dylib        	0x17e856c8 HTMLContentSink::ProcessSCRIPTEndTag(nsGenericHTMLElement*, int) + 292 (nsHTMLContentSink.cpp:3145)
27  libgklayout.dylib        	0x17e87362 SinkContext::CloseContainer(nsHTMLTag, int) + 1360 (nsHTMLContentSink.cpp:1008)
28  libgklayout.dylib        	0x17e8783d HTMLContentSink::CloseContainer(nsHTMLTag) + 299 (nsHTMLContentSink.cpp:2408)
29  libhtmlpars.dylib        	0x3b711c58 CNavDTD::CloseContainer(nsHTMLTag, int) + 576 (CNavDTD.cpp:2678)
30  libhtmlpars.dylib        	0x3b713dc8 CNavDTD::HandleEndToken(CToken*) + 908 (CNavDTD.cpp:1588)
31  libhtmlpars.dylib        	0x3b71660c CNavDTD::HandleToken(CToken*, nsIParser*) + 1576 (CNavDTD.cpp:703)
32  libhtmlpars.dylib        	0x3b710585 CNavDTD::BuildModel(nsIParser*, nsITokenizer*, nsITokenObserver*, nsIContentSink*) + 949 (CNavDTD.cpp:331)
33  libhtmlpars.dylib        	0x3b7206e9 nsParser::BuildModel() + 291 (nsParser.cpp:1754)
34  libhtmlpars.dylib        	0x3b723158 nsParser::ResumeParse(int, int, int) + 454 (nsParser.cpp:1631)
35  libhtmlpars.dylib        	0x3b7239bc nsParser::ContinueInterruptedParsing() + 192 (nsParser.cpp:1118)
36  libgklayout.dylib        	0x17d8e880 nsContentSink::ContinueInterruptedParsingIfEnabled() + 102 (nsContentSink.cpp:1534)
37  libgklayout.dylib        	0x1824bcc5 nsRunnableMethod<nsContentSink>::Run() + 85 (nsThreadUtils.h:262)
38  libxpcom_core.dylib      	0x01358bda nsThread::ProcessNextEvent(int, int*) + 508 (nsThread.cpp:483)
39  libxpcom_core.dylib      	0x0130464b NS_ProcessPendingEvents_P(nsIThread*, unsigned) + 91 (nsThreadUtils.cpp:180)
40  libwidget_mac.dylib      	0x054cf2ea nsBaseAppShell::Run() + 100 (nsBaseAppShell.cpp:157)
41  libwidget_mac.dylib      	0x054b3598 nsAppShell::Run() + 190 (nsAppShell.mm:348)
42  libwidget_mac.dylib      	0x054b387a -[AppShellDelegate runAppShell] + 36 (nsAppShell.mm:447)
43  com.apple.Foundation     	0x9280503b __NSFireDelayedPerform + 403
44  com.apple.CoreFoundation 	0x9082c7e2 CFRunLoopRunSpecific + 3341
45  com.apple.CoreFoundation 	0x9082bace CFRunLoopRunInMode + 61
46  com.apple.HIToolbox      	0x92de78d8 RunCurrentEventLoopInMode + 285
47  com.apple.HIToolbox      	0x92de6f19 ReceiveNextEventCommon + 184
48  com.apple.HIToolbox      	0x92de6e39 BlockUntilNextEventMatchingListInMode + 81
49  com.apple.AppKit         	0x9328d465 _DPSNextEvent + 572
50  com.apple.AppKit         	0x9328d056 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 137
51  libwidget_mac.dylib      	0x054b338f nsAppShell::ProcessNextNativeEvent(int) + 275 (nsAppShell.mm:302)
52  libwidget_mac.dylib      	0x054cf273 nsBaseAppShell::DoProcessNextNativeEvent(int) + 51 (nsBaseAppShell.cpp:137)
53  libwidget_mac.dylib      	0x054cf638 nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned) + 94 (nsBaseAppShell.cpp:225)
54  libwidget_mac.dylib      	0x054b365a nsAppShell::OnProcessNextEvent(nsIThreadInternal*, int, unsigned) + 180 (nsAppShell.mm:372)
55  libxpcom_core.dylib      	0x01358ad6 nsThread::ProcessNextEvent(int, int*) + 248 (nsThread.cpp:472)
56  libxpcom_core.dylib      	0x0130464b NS_ProcessPendingEvents_P(nsIThread*, unsigned) + 91 (nsThreadUtils.cpp:180)
57  libwidget_mac.dylib      	0x054cf20f nsBaseAppShell::NativeEventCallback() + 83 (nsBaseAppShell.cpp:116)
58  libwidget_mac.dylib      	0x054b3e17 nsAppShell::ProcessGeckoEvents() + 263 (nsAppShell.mm:213)
59  libwidget_mac.dylib      	0x054b3f61 -[AppShellDelegate handlePortMessage:] + 107 (nsAppShell.mm:438)
60  com.apple.Foundation     	0x928409c0 __NSFireMachPort + 307
61  com.apple.CoreFoundation 	0x9083c385 __CFMachPortPerform + 136
62  com.apple.CoreFoundation 	0x9082c62d CFRunLoopRunSpecific + 2904
63  com.apple.CoreFoundation 	0x9082bace CFRunLoopRunInMode + 61
64  com.apple.HIToolbox      	0x92de78d8 RunCurrentEventLoopInMode + 285
65  com.apple.HIToolbox      	0x92de6fe2 ReceiveNextEventCommon + 385
66  com.apple.HIToolbox      	0x92de6e39 BlockUntilNextEventMatchingListInMode + 81
67  com.apple.AppKit         	0x9328d465 _DPSNextEvent + 572
68  com.apple.AppKit         	0x9328d056 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 137
69  com.apple.AppKit         	0x93286ddb -[NSApplication run] + 512
70  libwidget_mac.dylib      	0x054b356c nsAppShell::Run() + 146 (nsAppShell.mm:345)
71  libtoolkitcomps.dylib    	0x16a74e1b nsAppStartup::Run() + 147 (nsAppStartup.cpp:171)
72  XUL                      	0x0020f4c1 XRE_main + 9817 (nsAppRunner.cpp:2814)
73  org.mozilla.firefox      	0x00002ec0 main + 40 (nsBrowserApp.cpp:70)
74  org.mozilla.firefox      	0x00002826 _start + 216
75  org.mozilla.firefox      	0x0000274d start + 41

Comment 1

[Boris Zbarsky [:bzbarsky]]

Well, either mScreenManager has issues or mWidget is garbage.... or something.

Comment 2

[Jesse Ruderman]

I'll take that as INCO.