Crash [@ nsPropertyTable::PropertyList::Equals][@ HandleEvent] with focusing setting iframe to dislay: none

RESOLVED FIXED

Status

()

Core
Layout
P2
critical
RESOLVED FIXED
10 years ago
7 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: roc)

Tracking

({crash, regression, testcase})

Trunk
x86
All
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
wanted-next +
blocking1.9 -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [depends on 395609], crash signature)

Attachments

(2 attachments)

(Reporter)

Description

10 years ago
Created attachment 286958 [details]
testcase

See testcase, which usually crashes for me after a few reloads.

I get a regression range of between 2007-09-20 and 2007-09-22 (but not sure if that says anything):
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-09-20+04&maxdate=2007-09-22+09&cvsroot=%2Fcvsroot

http://crash-stats.mozilla.com/report/index/a0ff5823-8872-11dc-ba5e-001a4bd43e5c
0  	nsPropertyTable::PropertyList::Equals(unsigned short, nsIAtom*)  	 mozilla/content/base/src/nsPropertyTable.cpp:85
1 	nsPropertyTable::GetPropertyListFor(unsigned short, nsIAtom*) 	mozilla/content/base/src/nsPropertyTable.cpp:295
2 	nsPropertyTable::GetPropertyInternal(nsPropertyOwner, unsigned short, nsIAtom*, int, unsigned int*) 	mozilla/content/base/src/nsPropertyTable.cpp:190
3 	nsPropertyTable::GetProperty(nsPropertyOwner, nsIAtom*, unsigned int*) 	mozilla/content/base/src/nsPropertyTable.h:113
4 	nsIFrame::GetProperty(nsIAtom*, unsigned int*) 	mozilla/layout/generic/nsFrame.cpp:5601
5 	nsIFrame::GetView() 	mozilla/layout/generic/nsFrame.cpp:3310
6 	nsFrame::Destroy() 	mozilla/layout/generic/nsFrame.cpp:480
7 	nsSubDocumentFrame::Destroy() 	mozilla/layout/generic/nsFrameFrame.cpp:624
8 	nsFrameList::DestroyFrames() 	mozilla/layout/generic/nsFrameList.cpp:67
9 	nsContainerFrame::Destroy() 	mozilla/layout/generic/nsContainerFrame.cpp:259
10 	nsFrameList::DestroyFrames() 	mozilla/layout/generic/nsFrameList.cpp:67
etc...

The xul code in the window is:
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<wizard>
<browser/>
</wizard>
</window>
Flags: blocking1.9?
(Reporter)

Comment 1

10 years ago
Created attachment 286959 [details]
zipped testcase2

This crashes too (and uses enhanced privileges). Unzip it and then open 'parentframe2.htm' to see the crash.
This has a different stacktrace, so that's why I'm attaching this on too.

http://crash-stats.mozilla.com/report/index/2c3e39e1-8865-11dc-b188-001a4bd43ed6
0  	@0x0  	
1 	HandleEvent 	mozilla/view/src/nsView.cpp:168
2 	nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus&) 	mozilla/widget/src/windows/nsWindow.cpp:1075
3 	nsWindow::DispatchWindowEvent(nsGUIEvent*, nsEventStatus&) 	mozilla/widget/src/windows/nsWindow.cpp:1100
4 	nsWindow::OnPaint(HDC__*) 	mozilla/widget/src/windows/nsWindow.cpp:5678
5 	nsWindow::ProcessMessage(unsigned int, unsigned int, long, long*) 	mozilla/widget/src/windows/nsWindow.cpp:4159
6 	nsWindow::WindowProc(HWND__*, unsigned int, unsigned int, long) 	mozilla/widget/src/windows/nsWindow.cpp:1288
7 	InternalCallWinProc 	
8 	UserCallWinProcCheckWow 	
9 	DispatchClientMessage 	
10 	__fnDWORD
(Reporter)

Updated

10 years ago
Blocks: 397114
Summary: Crash [@ nsPropertyTable::PropertyList::Equals] with focusing setting iframe to dislay: none → Crash [@ nsPropertyTable::PropertyList::Equals][@ HandleEvent] with focusing setting iframe to dislay: none

Updated

10 years ago
OS: Windows XP → All

Comment 2

10 years ago
I see ###!!! ASSERTION: reflowing in the middle of frame construction: 'mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0', file /home/smaug/mozilla/mozilla_cvs/mozilla/layout/base/nsPresContext.h, line 924
before the crash, when testing the first testcase.
Re-entering reflow sounds like a layout bug.

Smaug, what's the stack when you get that assertion?
Component: Event Handling → Layout
QA Contact: events → layout
I don't get the assert, but I do get the crash, under reflow event processing.  The key is:

#3  0xb4c80a64 in PresShell::HandlePostedReflowCallbacks (this=0x9269478)
    at ../../../mozilla/layout/base/nsPresShell.cpp:4375
4375           if (callback->ReflowFinished()) {
(gdb) p mIsDestroying
$3 = 1 '\001'

So either the ReflowFinished() call or something before it killed this presshell.
Oh, the callback is nsSubDocumentFrame.
So that crash is due to a local patch that hasn't landed yet...  So it's not the issue this bug is about.
Flags: blocking1.9? → blocking1.9+
Priority: -- → P4
Assignee: nobody → roc
The is the stack for the "reflowing in the middle of frame construction" assertion:

#0  NS_DebugBreak_P (aSeverity=1, aStr=0x1852cad8 "reflowing in the middle of frame construction", aExpr=0x1852ca30 "mPresContext->mLayoutPhaseCount[eLayoutPhase_FrameC] == 0", aFile=0x1852c938 "../../dist/include/layout/nsPresContext.h", aLine=926) at /Users/roc/mozilla-trunk/xpcom/base/nsDebugImpl.cpp:263
#1  0x1859e5eb in nsAutoLayoutPhase::Enter (this=0xbfffc3c8) at ../../dist/include/layout/nsPresContext.h:925
#2  0x1859e714 in nsAutoLayoutPhase::nsAutoLayoutPhase (this=0xbfffc3c8, aPresContext=0x402e0db0, aPhase=eLayoutPhase_Reflow) at ../../dist/include/layout/nsPresContext.h:900
#3  0x17edde8e in PresShell::ProcessReflowCommands (this=0x237f400, aInterruptible=0) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:6267
#4  0x17ede1d0 in PresShell::DoFlushPendingNotifications (this=0x237f400, aType=Flush_Layout, aInterruptibleReflow=0) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:4505
#5  0x17ede3b8 in PresShell::FlushPendingNotifications (this=0x237f400, aType=Flush_Layout) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:4445
#6  0x17eb06be in DocumentViewerImpl::LoadComplete (this=0x40216b60, aStatus=0) at /Users/roc/mozilla-trunk/layout/base/nsDocumentViewer.cpp:946
#7  0x3076859d in nsDocShell::EndPageLoad (this=0x40402490, aProgress=0x404024a4, aChannel=0x4025f8a0, aStatus=0) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:5019
#8  0x3077228a in nsWebShell::EndPageLoad (this=0x40402490, aProgress=0x404024a4, channel=0x4025f8a0, aStatus=0) at /Users/roc/mozilla-trunk/docshell/base/nsWebShell.cpp:1013
#9  0x30759763 in nsDocShell::OnStateChange (this=0x40402490, aProgress=0x404024a4, aRequest=0x4025f8a0, aStateFlags=131088, aStatus=0) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:4919
#10 0x30781bcb in nsDocLoader::FireOnStateChange (this=0x40402490, aProgress=0x404024a4, aRequest=0x4025f8a0, aStateFlags=131088, aStatus=0) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:1235
#11 0x30781f22 in nsDocLoader::doStopDocumentLoad (this=0x40402490, request=0x4025f8a0, aStatus=0) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:858
#12 0x30782117 in nsDocLoader::DocLoaderIsEmpty (this=0x40402490) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:763
#13 0x307ce36c in nsDocLoader::ChildDoneWithOnload (this=0x40402490, aChild=0x402de820) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.h:205
#14 0x30782145 in nsDocLoader::DocLoaderIsEmpty (this=0x402de820) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:766
#15 0x30782c26 in nsDocLoader::OnStopRequest (this=0x402de820, aRequest=0x3fcdf470, aCtxt=0x0, aStatus=2152398850) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:679
#16 0x13a4f92f in nsLoadGroup::RemoveRequest (this=0x402dea30, request=0x3fcdf470, ctxt=0x0, aStatus=2152398850) at /Users/roc/mozilla-trunk/netwerk/base/src/nsLoadGroup.cpp:688
#17 0x13a4e782 in nsLoadGroup::Cancel (this=0x402dea30, status=2152398850) at /Users/roc/mozilla-trunk/netwerk/base/src/nsLoadGroup.cpp:341
#18 0x30782263 in nsDocLoader::Stop (this=0x402de820) at /Users/roc/mozilla-trunk/uriloader/base/nsDocLoader.cpp:311
#19 0x307b28f9 in nsDocShell::Stop (this=0x402de820) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.h:218
#20 0x3076449c in nsDocShell::Stop (this=0x402de820, aStopFlags=3) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:3349
#21 0x3076735e in nsDocShell::Destroy (this=0x402de820) at /Users/roc/mozilla-trunk/docshell/base/nsDocShell.cpp:3622
#22 0x180f7c99 in nsFrameLoader::Destroy (this=0x3fccad30) at /Users/roc/mozilla-trunk/content/base/src/nsFrameLoader.cpp:265
#23 0x17f1fbac in nsSubDocumentFrame::Destroy (this=0x24daef0) at /Users/roc/mozilla-trunk/layout/generic/nsFrameFrame.cpp:745
#24 0x17f20fd4 in nsFrameList::DestroyFrames (this=0x40800e6c) at /Users/roc/mozilla-trunk/layout/generic/nsFrameList.cpp:67
#25 0x17f08b5f in nsContainerFrame::Destroy (this=0x40800e38) at /Users/roc/mozilla-trunk/layout/generic/nsContainerFrame.cpp:257
#26 0x18069fe0 in nsBoxFrame::Destroy (this=0x40800e38) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsBoxFrame.cpp:961
#27 0x17f20fd4 in nsFrameList::DestroyFrames (this=0x408008b0) at /Users/roc/mozilla-trunk/layout/generic/nsFrameList.cpp:67
#28 0x17f08b5f in nsContainerFrame::Destroy (this=0x4080087c) at /Users/roc/mozilla-trunk/layout/generic/nsContainerFrame.cpp:257
#29 0x18069fe0 in nsBoxFrame::Destroy (this=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsBoxFrame.cpp:961
#30 0x1807e229 in nsDocElementBoxFrame::Destroy (this=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsDocElementBoxFrame.cpp:109
#31 0x1806ac04 in nsBoxFrame::RemoveFrame (this=0x40800540, aListName=0x0, aOldFrame=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsBoxFrame.cpp:1024
#32 0x180655b4 in nsRootBoxFrame::RemoveFrame (this=0x40800540, aListName=0x0, aOldFrame=0x4080087c) at /Users/roc/mozilla-trunk/layout/xul/base/src/nsRootBoxFrame.cpp:212
#33 0x17eb8608 in nsFrameManager::RemoveFrame (this=0x237f41c, aParentFrame=0x40800540, aListName=0x0, aOldFrame=0x4080087c) at /Users/roc/mozilla-trunk/layout/base/nsFrameManager.cpp:694
#34 0x17e8fe6f in nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal (this=0x3fcc2900) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:7821
#35 0x17e8ff91 in nsCSSFrameConstructor::ReconstructDocElementHierarchy (this=0x3fcc2900) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:7764
#36 0x17e90230 in nsCSSFrameConstructor::RecreateFramesForContent (this=0x3fcc2900, aContent=0x237a228) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:11252
#37 0x17e90898 in nsCSSFrameConstructor::RestyleElement (this=0x3fcc2900, aContent=0x237a228, aPrimaryFrame=0x4080087c, aMinHint=0) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:10060
#38 0x17e90aa7 in nsCSSFrameConstructor::ProcessOneRestyle (this=0x3fcc2900, aContent=0x237a228, aRestyleHint=eReStyle_Self, aChangeHint=0) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:13166
#39 0x17e937ac in nsCSSFrameConstructor::ProcessPendingRestyles (this=0x3fcc2900) at /Users/roc/mozilla-trunk/layout/base/nsCSSFrameConstructor.cpp:13254
#40 0x17ede15b in PresShell::DoFlushPendingNotifications (this=0x237f400, aType=Flush_Layout, aInterruptibleReflow=1) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:4479
#41 0x17ede302 in PresShell::ReflowEvent::Run (this=0x3fcc1860) at /Users/roc/mozilla-trunk/layout/base/nsPresShell.cpp:6045
#42 0x01376cb7 in nsThread::ProcessNextEvent (this=0x29132e0, mayWait=0, result=0xbfffdbf4) at /Users/roc/mozilla-trunk/xpcom/threads/nsThread.cpp:510

Comment 8

10 years ago
This is possibly a dup of Bug 395609.
That one makes the evil part of nsFrameLoader::Destroy asynchronous or
executed at a "safe time" - at least tries to.
Yes, I think you're right.
Depends on: 395609
Whiteboard: [depends on 395609]
Priority: P4 → P2
We wouldn't block just for this, although I think we should get the underlying bug fixed for 1.9.
Flags: wanted-next+
Flags: blocking1.9-

Updated

10 years ago
Flags: tracking1.9+
(Reporter)

Comment 11

10 years ago
This is worksforme, now, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008032204 Minefield/3.0b5pre
So I guess fixed by bug 395609.
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsPropertyTable::PropertyList::Equals] [@ HandleEvent]
You need to log in before you can comment on or make changes to this bug.