407047 - Crash [@ nsHTMLScrollFrame::ReflowScrolledFrame]

Status: RESOLVED DUPLICATE of bug 407009

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build after 200ms.

This regressed between 2007-12-04 and 2007-12-05:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-12-04+04&maxdate=2007-12-05+09&cvsroot=%2Fcvsroot
Regression from bug 395107? Or bug 406485? Or bug 375304? (or other bug?)

I can look for a smaller regression range, if wanted (by using the tinderbox builds).

http://crash-stats.mozilla.com/report/index/034e2263-a37c-11dc-8292-001a4bd43ed6
0  	nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState*, int, int, nsHTMLReflowMetrics*, int)  	 mozilla/layout/generic/nsGfxScrollFrame.cpp:442
1 	nsHTMLScrollFrame::ReflowContents(ScrollReflowState*, nsHTMLReflowMetrics const&) 	mozilla/layout/generic/nsGfxScrollFrame.cpp:564
2 	nsHTMLScrollFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsGfxScrollFrame.cpp:761
3 	nsListControlFrame::ReflowAsDropdown(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/forms/nsListControlFrame.cpp:776
4 	nsListControlFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/forms/nsListControlFrame.cpp:568
5 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:722
6 	nsComboboxControlFrame::ReflowDropdown(nsPresContext*, nsHTMLReflowState const&) 	mozilla/layout/forms/nsComboboxControlFrame.cpp:490
7 	nsComboboxControlFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/forms/nsComboboxControlFrame.cpp:666
8 	nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, int&) 	mozilla/layout/generic/nsLineLayout.cpp:894
9 	nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) 	mozilla/layout/generic/nsBlockFrame.cpp:3577
10 	nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, int*, LineReflowStatus*, int) 	mozilla/layout/generic/nsBlockFrame.cpp:3400
etc...

Comment 1

[Brian Polidoro]

See bug 407009 which even mentions possibly crashing here.

Comment 2

[Martijn Wargers (dead)]

Would have been nice if that bug actually posted the stack in the summary :(

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

My patch in bug 407009 fixes this. I'll just make it a dup.