486701 - crash [@ nsTableFrame::PaintTableBorderBackground][@ 0x0 - nsTableFrame::PaintTableBorderBackground]

Status: RESOLVED WORKSFORME

(Core :: Layout: Tables, defect)

Description

[Seth Spitzer]

crash @ nsTableFrame::PaintTableBorderBackground

from about:crashes, I was able to find:

http://crash-stats.mozilla.com/report/index/df4b603a-61b9-49ec-b748-5307f2090401
http://crash-stats.mozilla.com/report/index/b770c97b-3839-4cf6-bfc4-067dc2090330
http://crash-stats.mozilla.com/report/index/768f5379-62b8-4034-a2fc-81f162090208

I've seen this crash with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3 (.NET CLR 3.5.30729)

But I also saw it with Firefox 3.0.6 and Firefox 3.0.7

In case the stacks disappear:

Crashing Thread
Frame 	Module 	Signature 	Source
0 		@0x0 	
1 	xul.dll 	nsTableFrame::PaintTableBorderBackground(nsIRenderingContext&,nsRect const&,nsPoint) 	layout/tables/nsTableFrame.cpp:1477
2 	xul.dll 	nsDisplayTableBorderBackground::Paint(nsDisplayListBuilder*,nsIRenderingContext*,nsRect const&) 	layout/tables/nsTableFrame.cpp:1318
3 	xul.dll 	nsDisplayList::Paint(nsDisplayListBuilder*,nsIRenderingContext*,nsRect const&) 	layout/base/nsDisplayList.cpp:311
4 	xul.dll 	nsDisplayClip::Paint(nsDisplayListBuilder*,nsIRenderingContext*,nsRect const&) 	layout/base/nsDisplayList.cpp:919
5 	xul.dll 	nsDisplayList::Paint(nsDisplayListBuilder*,nsIRenderingContext*,nsRect const&) 	layout/base/nsDisplayList.cpp:311
6 	xul.dll 	nsLayoutUtils::PaintFrame(nsIRenderingContext*,nsIFrame*,nsRegion const&,unsigned int) 	layout/base/nsLayoutUtils.cpp:1139
7 	xul.dll 	PresShell::Paint(nsIView*,nsIRenderingContext*,nsRegion const&) 	layout/base/nsPresShell.cpp:5468
8 	xul.dll 	nsViewManager::RenderViews(nsView*,nsIRenderingContext&,nsRegion const&) 	view/src/nsViewManager.cpp:638
9 	xul.dll 	nsViewManager::Refresh(nsView*,nsIRenderingContext*,nsIRegion*,unsigned int) 	view/src/nsViewManager.cpp:512
10 	xul.dll 	xul.dll@0x31d569 	
11 	xul.dll 	HandleEvent 	view/src/nsView.cpp:167
12 	xul.dll 	nsWindow::DispatchEvent(nsGUIEvent*,nsEventStatus&) 	widget/src/windows/nsWindow.cpp:1020
13 	xul.dll 	nsWindow::DispatchWindowEvent(nsGUIEvent*,nsEventStatus&) 	widget/src/windows/nsWindow.cpp:1045
14 	xul.dll 	xul.dll@0x333f51 	
15 	xul.dll 	nsWindow::ProcessMessage(unsigned int,unsigned int,long,long*) 	widget/src/windows/nsWindow.cpp:4434
16 	xul.dll 	nsWindow::WindowProc(HWND__*,unsigned int,unsigned int,long) 	widget/src/windows/nsWindow.cpp:1236
17 	user32.dll 	user32.dll@0x8733 	
18 	user32.dll 	user32.dll@0x8815 	
19 	user32.dll 	user32.dll@0x18e9f 	
20 	user32.dll 	user32.dll@0x18eeb 	
21 	ntdll.dll 	ntdll.dll@0xe452 	
22 	xul.dll 	nsWindow::Update() 	widget/src/windows/nsWindow.cpp:2823
23 	xul.dll 	nsViewManager::UpdateWidgetsForView(nsView*) 	view/src/nsViewManager.cpp:1782
24 	xul.dll 	nsViewManager::ForceUpdate() 	view/src/nsViewManager.cpp:2035
25 	xul.dll 	nsViewManager::Composite() 	view/src/nsViewManager.cpp:687
26 	xul.dll 	nsViewManager::EnableRefresh(unsigned int) 	view/src/nsViewManager.cpp:1953
27 	xul.dll 	nsViewManager::EndUpdateViewBatch(unsigned int) 	view/src/nsViewManager.cpp:2002
28 	xul.dll 	nsIViewManager::UpdateViewBatch::EndUpdateViewBatch(unsigned int) 	obj-firefox/dist/include/view/nsIViewManager.h:384
29 	xul.dll 	nsEditor::EndUpdateViewBatch() 	editor/libeditor/base/nsEditor.cpp:4348
30 	xul.dll 	nsEditor::EndPlaceHolderTransaction() 	editor/libeditor/base/nsEditor.cpp:956
31 	xul.dll 	nsAutoPlaceHolderBatch::~nsAutoPlaceHolderBatch() 	editor/libeditor/base/nsEditorUtils.h:66
32 	xul.dll 	nsPlaintextEditor::InsertText(nsAString_internal const&) 	editor/libeditor/text/nsPlaintextEditor.cpp:769
33 	xul.dll 	nsTextControlFrame::SetValue(nsAString_internal const&) 	layout/forms/nsTextControlFrame.cpp:2759
34 	xul.dll 	nsRefPtr<nsIDOMEventListener>::~nsRefPtr<nsIDOMEventListener>() 	obj-firefox/dist/include/xpcom/nsAutoPtr.h:956
35 	xul.dll 	nsTextControlFrame::SetFormProperty(nsIAtom*,nsAString_internal const&) 	layout/forms/nsTextControlFrame.cpp:1960
36 	xul.dll 	nsHTMLInputElement::SetValueInternal(nsAString_internal const&,nsITextControlFrame*,int) 	content/html/content/src/nsHTMLInputElement.cpp:949

Comment 1

[Seth Spitzer]

In case it helps, from about:crashes:

Report ID                               Date Submitted    
df4b603a-61b9-49ec-b748-5307f2090401	4/1/2009	11:07 PM
ee1537a8-55a7-4ec3-b15b-4378f2090401	4/1/2009	9:29 PM
b770c97b-3839-4cf6-bfc4-067dc2090330	3/30/2009	4:56 PM
f8b4214e-35a5-4190-97fc-55d0e2090309	3/9/2009	12:26 AM
d8797d7d-6035-41c2-b0aa-c364a2090308	3/8/2009	3:24 PM
023f6791-0af8-4ba5-a9c1-be9fe2090222	2/22/2009	3:16 PM
c7187a0a-a52b-430a-a72b-9a6ac2090221	2/21/2009	8:11 PM
7263f54d-5f44-4fc9-a745-bfe0c2090221	2/21/2009	8:09 PM
768f5379-62b8-4034-a2fc-81f162090208	2/8/2009	11:48 PM
86569331-52a9-4393-b812-717cf2090208	2/8/2009	11:47 PM
0d27e6aa-0fde-47a8-8164-c69f02090201	2/1/2009	3:59 PM
f7d2bfae-c2fe-4dce-adbc-5076f2090201	2/1/2009	2:26 PM
215ed40a-5a61-4241-b3ac-9a3322090201	2/1/2009	2:25 PM
8942361b-c086-4e28-bdae-65ae72090201	2/1/2009	1:45 PM
92ac9064-50ef-4931-98b3-b6cb62090201	2/1/2009	1:44 PM
2a107adf-3d34-4830-8fac-1858c2090129	1/29/2009	11:49 PM
5fe7d637-ee1e-484d-b098-8d20b2090129	1/29/2009	11:47 PM
6a58c445-9631-4e10-b4e8-7ea3c2081228	12/28/2008	9:02 AM
a0e7a977-1b7d-463a-8db6-a11022081228	12/28/2008	9:02 AM
f22e2e04-380d-4860-8bba-b832d2081228	12/28/2008	9:01 AM
78e88b9a-73a7-4476-b257-253af2081228	12/28/2008	9:00 AM
b953fc3e-b917-4cd8-896e-8a2542081228	12/28/2008	9:00 AM
c76a4631-3f3e-44cb-bdcc-2f27b2081228	12/28/2008	8:55 AM

Comment 2

[Seth Spitzer]

in case it helps, I would crash while watching videos on http://www.myvideofight.com/

Comment 3

[Marcia Knous [:marcia]]

Thanks for the report Seth - which version of flash are you using?

Comment 4

[Seth Spitzer]

from about:plugins:

Shockwave Flash

    File name: NPSWF32.dll
    Shockwave Flash 10.0 r12

MIME Type 	Description 	Suffixes 	Enabled
application/x-shockwave-flash 	Adobe Flash movie 	swf 	Yes
application/futuresplash 	FutureSplash movie 	spl 	Yes

Comment 5

[Seth Spitzer]

:Natch, this is on both 3.0.x and 3.1b3, in case that matters.

Comment 6

[Nochum Sossonko [:Natch]]

Hrm, I was just replacing the previous value (3.0), but I guess the latest version with this crash is probably what's important...

Comment 7

[Bernd]

The code where it crashes 

1476     if (!IsBorderCollapse()) {
1477       PRIntn skipSides = GetSkipSides();
1478       nsRect rect(aPt, mRect.Size());

looks pretty much like a deleted frame that gets painted. I have seen a couple of asserts about frame construction during painting at http://www.myvideofight.com/ but without clear reproducible steps there is no way to get this crash fixed.

Comment 8

[Seth Spitzer]

> without clear reproducible steps there is no way to get this crash fixed.

sorry I don't have good steps to reproduce this crasher.

when it happens, I'm opening videos in background tabs and then attempting to play them.

Comment 9

[Jesse Ruderman on Windows]

Bernd, do you still get those assertion failures?  Is there a bug on them?

Seth, I think your best bet is to browse using a debug build, and note the assertions that accompany this crash.  Layout code is pretty good about asserting before crashing.

Comment 10

[Seth Spitzer]

Jesse, I'm still visiting http://www.myvideofight.com/, but I haven't seen this crasher in a while.  But I've also upgraded flash and I'm using 3.5.3.  If I see it again, I'll report back here.

Perhaps someone can query crash reports to see if this has gone away and is now worksforme?

Comment 11

[Jesse Ruderman on Windows]

crash-stats shows about 4 per day.  I don't think that's worth filing a bug for.

I don't get any assertions when I load http://www.myvideofight.com/ in a Mac trunk debug build.