Closed Bug 420915 Opened 17 years ago Closed 6 years ago

Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]

Categories

(Core :: XUL, defect)

Product:
Core
Component:
XUL
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: whimboo, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [tbird crash][rare])

Crash Data

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008030405 Minefield/3.0b5pre ID:2008030405 Trying to reproduce the STR in bug 420905. While getting the infinite list of assertion dialogs I tried to stop it with massively hitting Esc and trying to close the history sidebar with the mouse. After a while Firefox crashed with the following stack: Breakpad ID: bp-ad731f47-ea1d-11dc-813b-001a4bd43ed6 0 nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*) mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1502 1 nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1667 2 nsTreeBodyFrame::GetCellAt(int, int, int*, nsITreeColumn**, nsACString_internal&) mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1064 3 nsTreeBoxObject::GetCellAt(int, int, int*, nsITreeColumn**, nsACString_internal&) mozilla/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp:434 4 nsXULTooltipListener::CheckTreeBodyMove(nsIDOMMouseEvent*) mozilla/layout/xul/base/src/nsXULTooltipListener.cpp:364 5 do_GetWeakReference(nsISupports*, unsigned int*) nsIWeakReferenceUtils.h:110 6 nsXULTooltipListener::MouseMove(nsIDOMEvent*) mozilla/layout/xul/base/src/nsXULTooltipListener.cpp:217
Using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b5pre) Gecko/2008030404 Minefield/3.0b5pre shows a similar stack trace: Breakpad ID: bp-3c23919e-ea20-11dc-94aa-001a4bd43ef6 First 20 frames: 0 @0x0 1 nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1667 2 nsTreeBodyFrame::GetCellAt(int, int, int*, nsITreeColumn**, nsACString_internal&) mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1064 3 NS_InvokeByIndex_P mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179 4 XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369 5 XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1470 6 js_Invoke mozilla/js/src/jsinterp.c:1444 7 js_Interpret mozilla/js/src/jsinterp.c:4805 8 js_Invoke mozilla/js/src/jsinterp.c:1460 9 js_InternalInvoke mozilla/js/src/jsinterp.c:1516 10 JS_CallFunctionValue mozilla/js/src/jsapi.c:4982 11 nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) mozilla/dom/src/base/nsJSEnvironment.cpp:1961 12 nsJSEventListener::HandleEvent(nsIDOMEvent*) mozilla/dom/src/events/nsJSEventListener.cpp:248 13 nsXBLPrototypeHandler::ExecuteHandler(nsPIDOMEventTarget*, nsIDOMEvent*) mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp:344 14 nsXBLEventHandler::HandleEvent(nsIDOMEvent*) mozilla/content/xbl/src/nsXBLEventHandler.cpp:86 15 nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsISupports*, unsigned int) mozilla/content/events/src/nsEventListenerManager.cpp:1082 16 nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned int, nsEventStatus*) mozilla/content/events/src/nsEventListenerManager.cpp:1186 17 nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int) mozilla/content/events/src/nsEventDispatcher.cpp:206 18 nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*) mozilla/content/events/src/nsEventDispatcher.cpp:264 19 nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) mozilla/content/events/src/nsEventDispatcher.cpp:479 20 PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*) mozilla/layout/base/nsPresShell.cpp:5895
OS: Windows XP → All
Hardware: PC → All
Summary: Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt] → Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt][@ nsTreeBodyFrame::GetCellAt]
Component: Layout → Layout: Tables
QA Contact: layout → layout.tables
Component: Layout: Tables → XP Toolkit/Widgets: Trees
QA Contact: layout.tables → xptoolkit.trees
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
Henrik, There still are a few nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) crashes bp-be6f4cc1-58c6-47f6-a04d-ce7552100724 FF 3.6.7 nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*) bp-146300c2-d585-4b8d-a40c-65a332100726 FF 3.6.8 bp-0abb0197-8812-4a64-9e14-961122100728 FF 3.6.8 (reporter: nikki) Thunderbird too. I didn't compare stacks to see if same. bp-7017acc1-d14c-4aa5-af02-0f6cc2100707 GetItemWithinCellAt
Summary: Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt][@ nsTreeBodyFrame::GetCellAt] → Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]
Crash Signature: [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]
Crash urls from last comment are broken. nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) crashes https://crash-stats.mozilla.com/report/index/55f09901-c2d2-40ff-a7d8-3a3dc2121227 's the latest one nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*) http://tinyurl.com/buxq7cd
Crash Signature: [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)] → [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]
bp-6785786e-2d4f-42bb-8df2-db2992130516 0 xul.dll nsTreeBodyFrame::GetItemWithinCellAt layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1463 1 xul.dll nsTreeBodyFrame::GetCellAt layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1638 2 xul.dll nsTreeBodyFrame::GetCursor layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2502 3 xul.dll nsEventStateManager::UpdateCursor content/events/src/nsEventStateManager.cpp:3574 4 xul.dll nsEventStateManager::PreHandleEvent content/events/src/nsEventStateManager.cpp:1062
Whiteboard: [tbird crash][rare]
Crash Signature: [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)] → [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)] [@ nsTreeBodyFrame::GetItemWithinCellAt] [@ nsTreeBodyFrame::GetCellAt]

No crashes in past week. I don't think this is actionable

Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.