398853 - Crash [@ UpdateViewsForTree] with opening window in new tab, setting fullZoom and changing styles

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, the testcases uses enhanced privileges, so you need to download it to your computer to see the crash.
Also, you need to have the option to open new windows in a new tab set, because for some strange reason, the testcase only crashes in a background tab.

This started crashing between 2007-07-25 and 2007-07-26, this is when the full zoom patch was checked in (bug 4821). Before that, the testcase doesn't crash for obvious reasons.

http://crash-stats.mozilla.com/report/index/d083c380-741c-11dc-aebf-001a4bd43ef6
0  	UpdateViewsForTree  	 mozilla/layout/base/nsCSSFrameConstructor.cpp:9620
1 	DoApplyRenderingChangeToTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9657
2 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9631
3 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
4 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
5 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
6 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
7 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
8 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
9 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
10 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
11 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
12 	UpdateViewsForTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9634
13 	DoApplyRenderingChangeToTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9657
14 	ApplyRenderingChangeToTree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9705
15 	nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList&) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9918
16 	nsPresContext::ClearStyleDataAndReflow() 	mozilla/layout/base/nsPresContext.cpp:726
17 	nsPresContext::SetFullZoom(float) 	mozilla/layout/base/nsPresContext.cpp:1165
18 	DocumentViewerImpl::SetFullZoom(float) 	mozilla/layout/base/nsDocumentViewer.cpp:2678
19 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
20 	AutoJSSuspendRequest::SuspendRequest() 	mozilla/js/src/xpconnect/src/xpcprivate.h:3318
21 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:1976
22 	xul.dll@0x5a9e3f

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase2

This testcase crashes with a different stack (the testcase also uses enhanced privileges).
But I suspect the cause of this crash is the same, the regression range is the same.

http://crash-stats.mozilla.com/report/index/a5bbb214-74f3-11dc-845f-001a4bd43ef6
0  	GetWidthInfo  	 mozilla/layout/tables/BasicTableLayoutStrategy.cpp:123
1 	BasicTableLayoutStrategy::ComputeColumnIntrinsicWidths(nsIRenderingContext*) 	mozilla/layout/tables/BasicTableLayoutStrategy.cpp:273
2 	BasicTableLayoutStrategy::ComputeIntrinsicWidths(nsIRenderingContext*) 	mozilla/layout/tables/BasicTableLayoutStrategy.cpp:581
3 	BasicTableLayoutStrategy::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/tables/BasicTableLayoutStrategy.cpp:69
4 	nsLayoutUtils::IntrinsicForContainer(nsIRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicWidthType) 	mozilla/layout/base/nsLayoutUtils.cpp:1444
5 	nsTableOuterFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/tables/nsTableOuterFrame.cpp:619
etc..

Comment 2

[Martijn Wargers (dead)]

Bernd, here is a similar case as bug 415323, that is still crashing in current trunk build (at least, testcase 2)

Comment 3

[Bernd]

this doesnt crash with a currentt debug build

Comment 4

[Martijn Wargers (dead)]

Ok, let's mark it wfm then.