Closed Bug 420915 Opened 16 years ago Closed 5 years ago

Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]

Categories

(Core :: XUL, defect)

Product:
Core
Component:
XUL
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: whimboo, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [tbird crash][rare])

Crash Data

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008030405 Minefield/3.0b5pre ID:2008030405

Trying to reproduce the STR in bug 420905. While getting the infinite list of assertion dialogs I tried to stop it with massively hitting Esc and trying to close the history sidebar with the mouse. After a while Firefox crashed with the following stack:

Breakpad ID: bp-ad731f47-ea1d-11dc-813b-001a4bd43ed6

0  	nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)  	 mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1502
1 	nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) 	mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1667
2 	nsTreeBodyFrame::GetCellAt(int, int, int*, nsITreeColumn**, nsACString_internal&) 	mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1064
3 	nsTreeBoxObject::GetCellAt(int, int, int*, nsITreeColumn**, nsACString_internal&) 	mozilla/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp:434
4 	nsXULTooltipListener::CheckTreeBodyMove(nsIDOMMouseEvent*) 	mozilla/layout/xul/base/src/nsXULTooltipListener.cpp:364
5 	do_GetWeakReference(nsISupports*, unsigned int*) 	nsIWeakReferenceUtils.h:110
6 	nsXULTooltipListener::MouseMove(nsIDOMEvent*) 	mozilla/layout/xul/base/src/nsXULTooltipListener.cpp:217
Using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b5pre) Gecko/2008030404 Minefield/3.0b5pre shows a similar stack trace:

Breakpad ID: bp-3c23919e-ea20-11dc-94aa-001a4bd43ef6

First 20 frames:
0  	@0x0  	
1 	nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) 	mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1667
2 	nsTreeBodyFrame::GetCellAt(int, int, int*, nsITreeColumn**, nsACString_internal&) 	mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1064
3 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
4 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369
5 	XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, long*) 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1470
6 	js_Invoke 	mozilla/js/src/jsinterp.c:1444
7 	js_Interpret 	mozilla/js/src/jsinterp.c:4805
8 	js_Invoke 	mozilla/js/src/jsinterp.c:1460
9 	js_InternalInvoke 	mozilla/js/src/jsinterp.c:1516
10 	JS_CallFunctionValue 	mozilla/js/src/jsapi.c:4982
11 	nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) 	mozilla/dom/src/base/nsJSEnvironment.cpp:1961
12 	nsJSEventListener::HandleEvent(nsIDOMEvent*) 	mozilla/dom/src/events/nsJSEventListener.cpp:248
13 	nsXBLPrototypeHandler::ExecuteHandler(nsPIDOMEventTarget*, nsIDOMEvent*) 	mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp:344
14 	nsXBLEventHandler::HandleEvent(nsIDOMEvent*) 	mozilla/content/xbl/src/nsXBLEventHandler.cpp:86
15 	nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsISupports*, unsigned int) 	mozilla/content/events/src/nsEventListenerManager.cpp:1082
16 	nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned int, nsEventStatus*) 	mozilla/content/events/src/nsEventListenerManager.cpp:1186
17 	nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int) 	mozilla/content/events/src/nsEventDispatcher.cpp:206
18 	nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*) 	mozilla/content/events/src/nsEventDispatcher.cpp:264
19 	nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) 	mozilla/content/events/src/nsEventDispatcher.cpp:479
20 	PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*) 	mozilla/layout/base/nsPresShell.cpp:5895
OS: Windows XP → All
Hardware: PC → All
Summary: Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt] → Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt][@ nsTreeBodyFrame::GetCellAt]
Component: Layout → Layout: Tables
QA Contact: layout → layout.tables
Component: Layout: Tables → XP Toolkit/Widgets: Trees
QA Contact: layout.tables → xptoolkit.trees
Component: XP Toolkit/Widgets: Trees → XUL
QA Contact: xptoolkit.trees → xptoolkit.widgets
Henrik,

There still are a few nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) crashes
bp-be6f4cc1-58c6-47f6-a04d-ce7552100724 FF 3.6.7

nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)
bp-146300c2-d585-4b8d-a40c-65a332100726 FF 3.6.8
bp-0abb0197-8812-4a64-9e14-961122100728 FF 3.6.8 (reporter: nikki)

Thunderbird too. I didn't compare stacks to see if same.
bp-7017acc1-d14c-4aa5-af02-0f6cc2100707 GetItemWithinCellAt
Summary: Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt][@ nsTreeBodyFrame::GetCellAt] → Firefox crashed while testing bug 420905 [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]
Crash Signature: [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]
Crash urls from last comment are broken.

nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**) crashes
https://crash-stats.mozilla.com/report/index/55f09901-c2d2-40ff-a7d8-3a3dc2121227
's the latest one

nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)
http://tinyurl.com/buxq7cd
Crash Signature: [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)] → [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)]
bp-6785786e-2d4f-42bb-8df2-db2992130516
0	xul.dll	nsTreeBodyFrame::GetItemWithinCellAt	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1463
1	xul.dll	nsTreeBodyFrame::GetCellAt	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:1638
2	xul.dll	nsTreeBodyFrame::GetCursor	layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp:2502
3	xul.dll	nsEventStateManager::UpdateCursor	content/events/src/nsEventStateManager.cpp:3574
4	xul.dll	nsEventStateManager::PreHandleEvent	content/events/src/nsEventStateManager.cpp:1062
Whiteboard: [tbird crash][rare]
Crash Signature: [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)] → [@ nsTreeBodyFrame::GetItemWithinCellAt(int, nsRect const&, int, nsTreeColumn*)] [@ nsTreeBodyFrame::GetCellAt(int, int, int*, nsTreeColumn**, nsIAtom**)] [@ nsTreeBodyFrame::GetItemWithinCellAt] [@ nsTreeBodyFrame::GetCellAt]

No crashes in past week. I don't think this is actionable

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.