392189 - Crash [@ChildIterator::get] with tabbrowser, tabs and onselect

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk builds on load.

This regressed between 2007-03-09 and 2007-03-10:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-03-09+04&maxdate=2007-03-10+08&cvsroot=%2Fcvsroot
Regression from bug 267833, somehow?

http://crash-stats.mozilla.com/report/index/26863d66-4951-11dc-bd8f-001a4bd43ed6
0  	ChildIterator::get()  	 e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nschilditerator.h:105
1 	nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:11278
2 	nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsStyleDisplay const*, nsIContent*, nsIFrame*, nsIFrame*, nsStyleContext*, nsIFrame**, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:12375
3 	nsCSSFrameConstructor::ConstructFrameByDisplayType(nsFrameConstructorState&, nsStyleDisplay const*, nsIContent*, int, nsIAtom*, nsIFrame*, nsStyleContext*, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:6433
4 	nsCSSFrameConstructor::ConstructFrameInternal(nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsStyleContext*, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:7653
5 	nsCSSFrameConstructor::ConstructFrame(nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:7475
6 	nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:11278
7 	nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsStyleDisplay const*, nsIContent*, nsIFrame*, nsIFrame*, nsStyleContext*, nsIFrame**, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:12375
8 	nsCSSFrameConstructor::ConstructFrameByDisplayType(nsFrameConstructorState&, nsStyleDisplay const*, nsIContent*, int, nsIAtom*, nsIFrame*, nsStyleContext*, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:6433
9 	nsCSSFrameConstructor::ConstructFrameInternal(nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIAtom*, int, nsStyleContext*, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:7653
10 	nsCSSFrameConstructor::ConstructFrame(nsFrameConstructorState&, nsIContent*, nsIFrame*, nsFrameItems&) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:7475
11 	nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsIFrame*, int, nsFrameItems&, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:11278
12 	nsCSSFrameConstructor::ConstructDocElementFrame(nsFrameConstructorState&, nsIContent*, nsIFrame*, nsIFrame**) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:4377
13 	nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, int, nsILayoutHistoryState*, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nscssframeconstructor.cpp:8879
14 	PresShell::InitialReflow(int, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\base\nspresshell.cpp:2370
15 	nsXULDocument::StartLayout() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\xul\document\src\nsxuldocument.cpp:1950
16 	nsXULDocument::DoneWalking() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\xul\document\src\nsxuldocument.cpp:3088
17 	nsXULDocument::StyleSheetLoaded(nsICSSStyleSheet*, int, unsigned int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\xul\document\src\nsxuldocument.cpp:3167
18 	CSSLoaderImpl::SheetComplete(SheetLoadData*, unsigned int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\style\nscssloader.cpp:1570
19 	CSSLoaderImpl::HandleLoadEvent(SheetLoadData*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\style\nscssloader.cpp:2125
20 	SheetLoadData::Run() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\layout\style\nscssloader.cpp:252
21 	nsThread::ProcessNextEvent(int, int*) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\xpcom\threads\nsthread.cpp:490
22 	NS_ProcessNextEvent_P(nsIThread*, int) 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\xpcom\build\nsthreadutils.cpp:227
23 	nsBaseAppShell::Run() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\widget\src\xpwidgets\nsbaseappshell.cpp:154
24 	nsAppStartup::Run() 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\toolkit\components\startup\src\nsappstartup.cpp:170
25 	XRE_main 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\toolkit\xre\nsapprunner.cpp:3059
26 	main 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\browser\app\nsbrowserapp.cpp:153
27 	WinMain 	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\browser\app\nsbrowserapp.cpp:166
28 	__tmainCRTStartup 	f:\rtm\vctools\crt_bld\self_x86\crt\src\crtexe.c:578
29 	BaseProcessStart

Comment 1

[Boris Zbarsky [:bzbarsky]]

Usual issue.  We're setting up an XBL binding inside frame construction.  chrome://global/content/bindings/scrollbox.xml to be exact.  One of the fields gets the computed direction, which triggers a style reresolve flush, which triggers a binding attachment flush, which fires a pending constructor, which fires an onselect event, which removes from the tree an ancestor of the node for which we're constructing frames.

Alternately, the field could do this last bit directly.  ;)

We need to fix bug 372769.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Please retest whether this is fixed?  I can't reproduce on trunk even without the patch for bug 372769...

Comment 3

[Martijn Wargers (dead)]

This is already worksforme, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007092705 Minefield/3.0a9pre

I guess this bug can be opened up, right? (since I didn't mention that it crashed on branch)