392123 - Crash [@nsIFrame::GetStateBits]

Status: RESOLVED DUPLICATE of bug 392285

(Core :: General, defect)

Description

[Paul Nickerson]

This bug has been automatically processed, reduced, and uploaded by Paul's Automated Pen-Tester alpha. It still may require more work.

Details:
eax=00000000 ebx=00000000 ecx=00000000 edx=00000001 esi=02366139 edi=0012faec
eip=0197f53a esp=0012f8b0 ebp=0012f8b4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
*** WARNING: Unable to verify checksum for C:\mozilla\mozilla\firefox-debug\dist\bin\components\gklayout.dll
gklayout!nsIFrame::GetStateBits+0xa:
0197f53a 8b4024          mov     eax,dword ptr [eax+24h] ds:0023:00000024=????????


Stack trace:
gklayout!nsIFrame::GetStateBits(void)
gklayout!IncrementalReflow::AddCommand(
                        class nsPresContext * aPresContext = 0x034e5170, 
                        class nsHTMLReflowCommand * aCommand = 0x036bfb40)
gklayout!PresShell::ProcessReflowCommands(
                        int aInterruptible = 1)
gklayout!ReflowEvent::HandleEvent(void)
gklayout!HandlePLEvent(
                        struct ReflowEvent * aEvent = 0x03c62d30)
xpcom_core!PL_HandleEvent(
                        struct PLEvent * self = 0x03c62d30)
xpcom_core!PL_ProcessPendingEvents(
                        struct PLEventQueue * self = 0x00bcd7c0)
xpcom_core!_md_EventReceiverProc(
                        struct HWND__ * hwnd = 0x00be0a34, 
                        unsigned int uMsg = 0xc1fe, 
                        unsigned int wParam = 0, 
                        long lParam = 12376000)
USER32!InternalCallWinProc
USER32!UserCallWinProcCheckWow
USER32!DispatchMessageWorker
USER32!DispatchMessageW
gkwidget!nsAppShell::Run(void)
tkitcmps!nsAppStartup::Run(void)
firefox!XRE_main(
                        int argc = 2, 
                        char ** argv = 0x00a078d8, 
                        struct nsXREAppData * aAppData = 0x0042401c)
firefox!main(
                        int argc = 2, 
                        char ** argv = 0x00a078d8)
firefox!mainCRTStartup(void)
kernel32!BaseProcessStart


A hash of the backtrace has been used to distinguish this from other bugs already reported by the tester. However, the automated pen-tester is still in development and this may not be the case. Also, I haven't added stack hashes to bugs that were not uploaded by the tester, so this bug may very well exist on bugzilla already.

Comment 1

[Paul Nickerson]

[STACKHASH:131195C1E2C4EEB643E3ACA5A383F76E]

Comment 2

[Paul Nickerson]

Attachment: Generated Testcase

Comment 3

[Daniel Veditz [:dveditz]]

Paul: if please change your filing tool to change the summary to 
"Crash [@nsIFrame::GetStateBits(void)]" to help talkback/breakpad searches for possible matching bugs for crash reports. And if possible please also add the "crash" keyword.

Comment 4

[Daniel Veditz [:dveditz]]

What build was tested? As long as you're filing this automatically please include the  user-agent of the build you tested (or at least the branch and buildid). Some crashes are recent regressions and/or are recently fixed, perhaps more recently than the version you tested. Knowing the build can be invaluable in figuring out a regression range, or a starting point when others get "works for me" results (is it fixed? is it platform specific? tied to your specific configuration somehow?).

Comment 5

[Martijn Wargers (dead)]

The Generated Testcase doesn't crash (for obvious reasons).
It would be nice to have a minimized testcase that does crash.

Comment 6

[Paul Nickerson]

Whoops, didn't even think of the absolute paths for some reason :P
I'll come up with a fix for that right away

Comment 7

[Paul Nickerson]

Attachment: Generate Testcase

Changed local paths to bugzilla paths

Comment 9

[Daniel Veditz [:dveditz]]

I'm going to call this a dupe of bug 392285. Paul originally duped them the other way and then thought better of it for some reason, but this bug crashes in 2.0.0.7 and is fixed in 2.0.0.8 like that one, and crashes in the same spot.