Last Comment Bug 477775 - Crash with iExploder test 2203 [@ nsComputedDOMStyle::GetWidth]
: Crash with iExploder test 2203 [@ nsComputedDOMStyle::GetWidth]
[sg:critical?] using destroyed frame ...
: crash, testcase, verified1.9.0.9, verified1.9.1
Product: Core
Classification: Components
Component: Layout (show other bugs)
: unspecified
: All All
P2 critical (vote)
: mozilla1.9.1b3
Assigned To: David Baron :dbaron: ⌚️UTC-8
: Jet Villegas (:jet)
Depends on: 454276
Blocks: iexploder
  Show dependency treegraph
Reported: 2009-02-10 03:54 PST by Mats Palmgren (:mats)
Modified: 2011-06-13 10:01 PDT (History)
10 users (show)
roc: blocking1.9.1+
dveditz: blocking1.9.0.9+
dveditz: wanted1.9.0.x+
dveditz: wanted1.8.1.x-
jruderman: in‑testsuite-
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Testcase (69.36 KB, text/html)
2009-02-10 03:54 PST, Mats Palmgren (:mats)
no flags Details
stack from a Linux debug build (8.28 KB, text/plain)
2009-02-10 04:01 PST, Mats Palmgren (:mats)
no flags Details
slightly reduced testcase (64.02 KB, text/html)
2009-02-13 11:13 PST, Jesse Ruderman
no flags Details

Description User image Mats Palmgren (:mats) 2009-02-10 03:54:34 PST
Created attachment 361494 [details]

Crash with iExploder test 2203 [@ nsComputedDOMStyle::GetWidth]

nsComputedDOMStyle::GetWidth	layout/style/nsComputedDOMStyle.cpp:2888
nsComputedDOMStyle::GetPropertyCSSValue	layout/style/nsComputedDOMStyle.cpp:366
nsComputedDOMStyle::GetPropertyValue	layout/style/nsComputedDOMStyle.cpp:300
nsComputedDOMStyle::GetPropertyValue	layout/style/nsComputedDOMStyle.cpp:244
CSS2PropertiesTearoff::GetWidth	layout/style/nsCSSPropList.h:543
NS_InvokeByIndex_P	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179
XPCWrappedNative::CallMethod	js/src/xpconnect/src/xpcwrappednative.cpp:2424
XPC_WN_GetterSetter	js/src/xpconnect/src/xpcprivate.h:2298
js_Invoke	js/src/jsinterp.cpp:1316
js_InternalInvoke	js/src/jsinterp.cpp:1392
JS_CallFunctionValue	js/src/jsapi.cpp:5299
XPCWrapper::GetOrSetNativeProperty	js/src/xpconnect/src/XPCWrapper.cpp:717
XPC_NW_GetOrSetProperty	js/src/xpconnect/src/XPCNativeWrapper.cpp:597
js_NativeGet	js/src/jsobj.cpp:3853
js_GetPropertyHelper	js/src/jsobj.cpp:4023
js_Interpret	js/src/jsinterp.cpp:4297
js_Invoke	js/src/jsinterp.cpp:1334
nsXPCWrappedJSClass::CallMethod	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1606
nsXPCWrappedJS::CallMethod	js/src/xpconnect/src/xpcwrappedjs.cpp:561
PrepareAndDispatch	xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
nsEventListenerManager::HandleEventSubType	content/events/src/nsEventListenerManager.cpp:1079
nsEventListenerManager::HandleEvent	content/events/src/nsEventListenerManager.cpp:1176
nsEventTargetChainItem::HandleEvent	content/events/src/nsEventDispatcher.cpp:227
nsEventTargetChainItem::HandleEventTargetChain	content/events/src/nsEventDispatcher.cpp:291
nsEventDispatcher::Dispatch	content/events/src/nsEventDispatcher.cpp:508
DocumentViewerImpl::LoadComplete	layout/base/nsDocumentViewer.cpp:997
nsDocShell::EndPageLoad	docshell/base/nsDocShell.cpp:5243
nsWebShell::EndPageLoad	docshell/base/nsWebShell.cpp:1015
nsDocShell::OnStateChange	docshell/base/nsDocShell.cpp:5139
nsDocLoader::FireOnStateChange	uriloader/base/nsDocLoader.cpp:1235
nsDocLoader::doStopDocumentLoad	uriloader/base/nsDocLoader.cpp:858
nsDocLoader::DocLoaderIsEmpty	uriloader/base/nsDocLoader.cpp:763
nsDocLoader::OnStopRequest	uriloader/base/nsDocLoader.cpp:679
nsLoadGroup::RemoveRequest	netwerk/base/src/nsLoadGroup.cpp:688
nsDocument::DoUnblockOnload	content/base/src/nsDocument.cpp:7080
nsDocument::DispatchContentLoadedEvents	content/base/src/nsDocument.cpp:3983
nsRunnableMethod<nsDocument>::Run	nsThreadUtils.h:264
nsThread::ProcessNextEvent	xpcom/threads/nsThread.cpp:510
NS_ProcessPendingEvents_P	nsThreadUtils.cpp:180
nsBaseAppShell::NativeEventCallback	widget/src/xpwidgets/nsBaseAppShell.cpp:121
nsAppShell::ProcessGeckoEvents	widget/src/cocoa/
nsAppShell::Run	widget/src/cocoa/
nsAppStartup::Run	toolkit/components/startup/src/nsAppStartup.cpp:192
XRE_main	toolkit/xre/nsAppRunner.cpp:3216
main	browser/app/nsBrowserApp.cpp:156
Comment 1 User image Mats Palmgren (:mats) 2009-02-10 04:01:21 PST
Created attachment 361495 [details]
stack from a Linux debug build
Comment 2 User image Jesse Ruderman 2009-02-13 00:59:10 PST
I'll try to make a reduced testcase.

The crash looks a lot like the one in bug 473410.
Comment 3 User image Jesse Ruderman 2009-02-13 11:13:19 PST
Created attachment 362267 [details]
slightly reduced testcase

Lithium was not able to remove much, despite the heterogeneity of the testcase.  Weird!
Comment 4 User image David Baron :dbaron: ⌚️UTC-8 2009-02-17 11:52:45 PST
Does the patch in bug 454276 fix this?
Comment 5 User image David Baron :dbaron: ⌚️UTC-8 2009-02-17 15:18:00 PST
Both testcases work for me in a 64-bit Linux debug build and both 32-bit and 64-bit Linux nightlies.
Comment 6 User image Robert O'Callahan (:roc) (email my personal email if necessary) 2009-02-19 19:39:10 PST
I don't crash on Mac debug either.

Jesse, what's your configuration these days?
Comment 8 User image Olli Pettay [:smaug] (pto-ish for couple of days) 2009-02-20 12:57:43 PST
I can reproduce the crash (64bit linux / debug), and the patch for bug 454276
does fix it.
Comment 9 User image David Baron :dbaron: ⌚️UTC-8 2009-02-21 11:46:06 PST
Any chance you could check that the new "alternative patch" (attachment 363493 [details] [diff] [review]) there also fixes it?
Comment 10 User image Mats Palmgren (:mats) 2009-02-21 14:08:29 PST
Yes, the new "alternative patch" fixes it.
Comment 11 User image David Baron :dbaron: ⌚️UTC-8 2009-02-24 20:52:50 PST
Fixed by checkin of bug 454276.
Comment 12 User image David Baron :dbaron: ⌚️UTC-8 2009-03-08 12:18:55 PDT
Fixed for by checkin to CVS trunk of bug 454276, 2009-03-08 12:16 -0700.
Comment 13 User image Al Billings [:abillings] 2009-03-20 11:00:37 PDT
This requires debug builds to repro the crash? I've tried it on OS X and Linux non-debug and get no crash with the testcase 2.
Comment 14 User image David Baron :dbaron: ⌚️UTC-8 2009-03-20 13:06:20 PDT
I could never reproduce the crash, and I was using debug builds.
Comment 15 User image Carsten Book [:Tomcat] 2009-04-02 16:13:52 PDT
verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5;
en-US; rv: Gecko/2009040221 Firefox/3.0.9pre (debug build) + : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/2009040214 Minefield/3.0.9pre - no crash on testcases
Comment 16 User image Jesse Ruderman 2009-04-21 14:38:55 PDT
in-testsuite- because we were never able to make a reduced testcase.
Comment 17 User image Aakash Desai [:aakashd] 2009-04-23 09:36:48 PDT
verified FIXED on builds: 
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090421 Minefield/3.6a1pre ID:20090421032809


Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090421 Shiretoko/3.5b4pre ID:20090421030848

Note You need to log in before you can comment on or make changes to this bug.