Status

()

Core
Layout: View Rendering
P1
critical
VERIFIED FIXED
17 years ago
17 years ago

People

(Reporter: buster, Assigned: Kevin McCluskey (gone))

Tracking

({crash, top100})

Trunk
x86
Windows NT
crash, top100
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [rtm++][Fix in Hand] Checked into trunk, super-reviewed, reviewed, URL)

Attachments

(9 attachments)

3.24 KB, text/html
Details
1.67 KB, text/html
Details
1.87 KB, patch
Details | Diff | Splinter Review
1.10 KB, patch
Details | Diff | Splinter Review
1.28 KB, patch
Details | Diff | Splinter Review
3.00 KB, patch
Details | Diff | Splinter Review
3.44 KB, patch
Details | Diff | Splinter Review
3.50 KB, patch
Details | Diff | Splinter Review
3.52 KB, patch
Details | Diff | Splinter Review
(Reporter)

Description

17 years ago
test case derived from bug 55880.
the stack below is a different stack than the crash I'm looking into.  May be
the same cause, different symptom, dunno.

nsViewManager2::RenderDisplayListElement(DisplayListElement2 * 0x02bb5030,
nsIRenderingContext & {...}) line 857 + 30 bytes
nsViewManager2::RenderViews(nsIView * 0x02bd6330, nsIRenderingContext & {...},
const nsRect & {...}, int & 0) line 806
nsViewManager2::Refresh(nsIView * 0x02bd6330, nsIRenderingContext * 0x02c326b0,
const nsRect * 0x0012f968, unsigned int 1) line 686
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x02ba84a0, nsGUIEvent *
0x0012faa8, nsEventStatus * 0x0012f9ac) line 1352
HandleEvent(nsGUIEvent * 0x0012faa8) line 68
nsWindow::DispatchEvent(nsWindow * const 0x02bd5734, nsGUIEvent * 0x0012faa8,
nsEventStatus & nsEventStatus_eIgnore) line 682 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012faa8, nsEventStatus &
nsEventStatus_eIgnore) line 708
nsWindow::OnPaint() line 3703 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long *
0x0012fe58) line 2806 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x063a047c, unsigned int 15, unsigned int 0, long
0) line 951 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
(Reporter)

Comment 1

17 years ago
keywords, keywords, keywords
Blocks: 55880
Keywords: crash, rtm
Priority: P3 → P1
(Reporter)

Comment 2

17 years ago
Created attachment 16926 [details]
sorta minimized test case.  change anything, and the crash seems to go away.  sometimes, you need to reload to see the crash
(Reporter)

Comment 3

17 years ago
crash on WinNT, debug build, code pulled 10:00am today (10/12/00)
(Assignee)

Comment 4

17 years ago
Here is the problem:

The radio button frame inquires what it's current check state is within its
paint method, this causes a flush of pending notifications which destroys the
view sitting in the display list that is being painted.

Here is a stack trace which shows the view is being destroyed from while the
display list is being painted.

nsDebug::Assertion(const char * 0x014e7564, const char * 0x014e7558, const char
* 0x014e7538, int 94) line 256 + 13 bytes
nsView::~nsView() line 94 + 32 bytes
nsView::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsView::Destroy(nsView * const 0x03b777a0) line 270 + 34 bytes
nsFrame::Destroy(nsFrame * const 0x01309a18, nsIPresContext * 0x03426cc0) line 426
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309a18, nsIPresContext *
0x03426cc0) line 99
nsBlockFrame::Destroy(nsBlockFrame * const 0x01309a18, nsIPresContext *
0x03426cc0) line 1233
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309b0c, nsIPresContext *
0x03426cc0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x01309b0c, nsIPresContext * 0x03426cc0)
line 1002 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x013043f0, nsIPresContext *
0x03426cc0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x013043f0, nsIPresContext * 0x03426cc0)
line 1002 + 13 bytes
nsGfxScrollFrame::Destroy(nsGfxScrollFrame * const 0x013043f0, nsIPresContext *
0x03426cc0) line 486
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309948, nsIPresContext *
0x03426cc0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x01309948, nsIPresContext * 0x03426cc0)
line 1002 + 13 bytes
nsGfxTextControlFrame2::Destroy(nsGfxTextControlFrame2 * const 0x01309948,
nsIPresContext * 0x03426cc0) line 1156 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01304b58, nsIPresContext *
0x03426cc0) line 98
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x013044a8)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x013094cc, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x01304520)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x01303df8, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130924c, nsIPresContext *
0x03426cc0) line 98
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309080, nsIPresContext *
0x03426cc0) line 98
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130903c, nsIPresContext *
0x03426cc0) line 98
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01308fd4, nsIPresContext *
0x03426cc0) line 98
nsTableFrame::Destroy(nsTableFrame * const 0x01308fd4, nsIPresContext *
0x03426cc0) line 269
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01308f80, nsIPresContext *
0x03426cc0) line 98
nsTableOuterFrame::Destroy(nsTableOuterFrame * const 0x01308f80, nsIPresContext
* 0x03426cc0) line 64
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x0130460c)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x013045c0, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x0130465c)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x013cfca8, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsBlockFrame::DoRemoveFrame(nsIPresContext * 0x03426cc0, nsIFrame * 0x013cfca8)
line 5518
nsBlockFrame::RemoveFrame(nsBlockFrame * const 0x013cfc5c, nsIPresContext *
0x03426cc0, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x013cfca8)
line 5416 + 16 bytes
FrameManager::RemoveFrame(FrameManager * const 0x0340ac30, nsIPresContext *
0x03426cc0, nsIPresShell & {...}, nsIFrame * 0x013cfc5c, nsIAtom * 0x00000000,
nsIFrame * 0x013cfca8) line 729
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x0340b870,
nsIPresContext * 0x03426cc0, nsIContent * 0x03d50d68, nsIContent * 0x034098a8,
int 1) line 9392 + 58 bytes
nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x0340b870,
nsIPresContext * 0x03426cc0, nsIContent * 0x03d50d68, nsIContent * 0x034098a8,
nsIContent * 0x034098a8, int 1) line 8949 + 28 bytes
nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x03426cc0,
nsIFrame * 0x01304314) line 13077 + 47 bytes
nsCSSFrameConstructor::ContentAppended(nsCSSFrameConstructor * const 0x0340b870,
nsIPresContext * 0x03426cc0, nsIContent * 0x034c98c8, int 2) line 8291 + 16 bytes
StyleSetImpl::ContentAppended(StyleSetImpl * const 0x0340b930, nsIPresContext *
0x03426cc0, nsIContent * 0x034c98c8, int 2) line 1138
PresShell::ContentAppended(PresShell * const 0x0340b508, nsIDocument *
0x03d1e7e0, nsIContent * 0x034c98c8, int 2) line 3649 + 46 bytes
nsDocument::ContentAppended(nsDocument * const 0x03d1e7e0, nsIContent *
0x034c98c8, int 2) line 1883
nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x03d1e7e0, nsIContent *
0x034c98c8, int 2) line 1303
HTMLContentSink::NotifyAppend(nsIContent * 0x034c98c8, int 2) line 4440
SinkContext::FlushTags(int 1) line 1981
HTMLContentSink::FlushPendingNotifications(HTMLContentSink * const 0x03d50b10)
line 5145 + 16 bytes
nsHTMLDocument::FlushPendingNotifications(nsHTMLDocument * const 0x03d1e7e0)
line 1372 + 23 bytes
nsGenericHTMLElement::GetPrimaryFrame(nsIHTMLContent * 0x0344ae4c,
nsIFormControlFrame * & 0x00000000, int 1) line 2382
nsHTMLInputElement::GetChecked(nsHTMLInputElement * const 0x0344ae40, int *
0x0012e258) line 473 + 51 bytes
nsFormControlFrame::GetCurrentCheckState(int * 0x0012e258) line 888 + 19 bytes
nsGfxRadioControlFrame::PaintRadioButton(nsIPresContext * 0x03426cc0,
nsIRenderingContext & {...}, const nsRect & {...}) line 279
nsGfxRadioControlFrame::Paint(nsGfxRadioControlFrame * const 0x013097ec,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 329
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013097ec, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsHTMLContainerFrame::Paint(nsHTMLContainerFrame * const 0x01304af8,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 108
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01304af8, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013094cc, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013094cc, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x01303df8, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01303df8, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsTableCellFrame::Paint(nsTableCellFrame * const 0x0130924c, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 366
nsTableRowFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 599
nsTableRowFrame::Paint(nsTableRowFrame * const 0x01309080, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 552
nsTableRowGroupFrame::PaintChildren(nsIPresContext * 0x03426cc0,
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 273
nsTableRowGroupFrame::Paint(nsTableRowGroupFrame * const 0x0130903c,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 227
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x0130903c, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsTableFrame::Paint(nsTableFrame * const 0x01308fd4, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 1370
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01308fd4, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsTableOuterFrame::Paint(nsTableOuterFrame * const 0x01308f80, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 352
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01308f80, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013045c0, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013045c0, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013cfca8, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013cfca8, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013cfc5c, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013cfc5c, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsHTMLContainerFrame::Paint(nsHTMLContainerFrame * const 0x013cede4,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 108
PresShell::Paint(PresShell * const 0x0340b504, nsIView * 0x034c4380,
nsIRenderingContext & {...}, const nsRect & {...}) line 4001 + 34 bytes
nsView::Paint(nsView * const 0x034c4380, nsIRenderingContext & {...}, const
nsRect & {...}, unsigned int 128, int & 268600245) line 291
nsViewManager2::RenderDisplayListElement(DisplayListElement2 * 0x03b96f60,
nsIRenderingContext & {...}) line 865
nsViewManager2::RenderViews(nsIView * 0x034c6310, nsIRenderingContext & {...},
const nsRect & {...}, int & 0) line 810
nsViewManager2::Refresh(nsIView * 0x034c6310, nsIRenderingContext * 0x03be0630,
const nsRect * 0x0012f6f8, unsigned int 1) line 689
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x0340bd70, nsGUIEvent *
0x0012f838, nsEventStatus * 0x0012f73c) line 1358
HandleEvent(nsGUIEvent * 0x0012f838) line 68
nsWindow::DispatchEvent(nsWindow * const 0x034c10f4, nsGUIEvent * 0x0012f838,
nsEventStatus & nsEventStatus_eIgnore) line 681 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f838, nsEventStatus &
nsEventStatus_eIgnore) line 707
nsWindow::OnPaint() line 3698 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long *
0x0012fbe8) line 2805 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x016b04d6, unsigned int 15, unsigned int 0, long
0) line 950 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()
(Assignee)

Comment 5

17 years ago
Marking [rtm need info]

I talked with buster and we came up with the following proposal for a fix:

Add a new method nsIViewManager which returns whether the viewmanager is
currently painting.

Add logic to NS_IMETHODIMP nsHTMLDocument::FlushPendingNotifications() to cycle
through the presshells asking their viewmanagers if their painting.

If any of the viewmanagers are currently painting then return immediately
without flushing the pending notifications.

Vidur: is this an acceptable solution?



Whiteboard: [rtm need info]
(Reporter)

Comment 6

17 years ago
Created attachment 16945 [details]
A somewhat more minimized test case, still very sensitive to any changes to the markup.  The key seems to be the combination of the input element and the script at the end of the file that resolves to a document.write
(Assignee)

Comment 7

17 years ago
Created attachment 16977 [details] [diff] [review]
viewmanager patch which adds IsPainting method
(Assignee)

Comment 8

17 years ago
Created attachment 16978 [details] [diff] [review]
nsHTMLDocument patch which ignores pending update flush if view manager is painting
(Assignee)

Comment 9

17 years ago
The two patches I attached stop the crashing for all of the test cases in this
bug. They also fix the crash in bug 55880.
(Reporter)

Comment 10

17 years ago
pres shells are ref counted, so you're leaking here:

nsIPresShell* shell = (nsIPresShell*) mPresShells.ElementAt(i);

you should change this to an nsCOMPtr.

You should probably fix whereever you copied this code from, too!

Pending this fix and vidur's review, a=buster
(Assignee)

Comment 11

17 years ago
mPresShells is a void array, so its not refcounted.
(Assignee)

Comment 12

17 years ago
Created attachment 17009 [details] [diff] [review]
Cleaned up nsHTMLDocument patch. Added NS_STATIC and NS_SUCCEEDED.
(Assignee)

Comment 13

17 years ago
Created attachment 17011 [details] [diff] [review]
Viewmanager patch which includes both viewmanager and viewmanager2
(Assignee)

Comment 14

17 years ago
Added [Fix in Hand] super-reviewed, waiting for review to status
Whiteboard: [rtm need info] → [rtm need info][Fix in Hand] super-reviewed, waiting for review
(Assignee)

Comment 15

17 years ago
CC'ing Johnny.
(Assignee)

Comment 16

17 years ago
Added top100, patch keywords

This bug is fairly serious.  It can cause random crashes on pages with form
elements. The URL in this bug crashes consistently, but other pages with form
elements may or may not crash depending on speed of the machine or network
connection. It all depends on what is sitting in pending reflow event queue when
the form elements are painting.

The patch'es prevent the processing of pending events while painting. The
pending events are NOT discarded, they will be processed after painting has
completed. The current behavior of processing the pending event during painting
is purely a undesirable side-effect of getting the current state for the form
element.



Keywords: patch, top100
(Reporter)

Comment 17

17 years ago
what about nsDocument::FlushPendingNotifications()?  It will get called by
nsXMLDocument, for example.  It's also possible for someone to call
nsIPresShell::FlushPendingNotifications() directly, rather than going through
the document.  I don't know if this happens anywhere, but it is part of the
public interface.

Comment 18

17 years ago
My suggestion to Kevin was that the test for nsIViewManager::IsPainting should
move to nsPresShell::FlushPendingNotifications. We already have a reentrancy
check in the latter to see if we're reflowing. Checking whether we're painting
as well is a logical addition. Kevin plans to repost a patch.
(Assignee)

Comment 19

17 years ago
It doesn't work if I move the logic to nsPresShell::FlushPendingNotifications.

The reason is:

the sink->FlushPendingNotifications() call in 
nsHTMLDocument::FlushPendingNotifications() results in destruction of frames and 
their associated views. The current patch works because it prevents both the 
flushing of the sink and nsPresShell.
(Assignee)

Comment 20

17 years ago
Created attachment 17056 [details] [diff] [review]
patch file with modifications to layout (nsHTMLDocument + nsPresShell)
(Assignee)

Comment 21

17 years ago
Created attachment 17064 [details] [diff] [review]
layout patch file with debug output when unsafe flush occurs
(Reporter)

Comment 22

17 years ago
*** Bug 55880 has been marked as a duplicate of this bug. ***
(Assignee)

Comment 23

17 years ago
Created attachment 17085 [details] [diff] [review]
Improved layout patch that prevents the sink from flushing if reflowing or painting

Comment 24

17 years ago
Applied the patches on Linux. Seems ok to me, IM and Chat worked fine in commercial.
(Reporter)

Comment 25

17 years ago
re-affirming sr=buster for the latest patch (10/13/00 18:13).
Please verify www.intel.com before checking this in.  In an earlier patch, I saw
some incomplete reflow problems that *may* have been related, but may not have
been.  I just want independent confirmation from kevin or anyone else who has
applied the patch that either www.intel.com lays out correctly with this change,
or that any problems on that page are unrelated to this change.
(Assignee)

Updated

17 years ago
Status: NEW → ASSIGNED

Comment 26

17 years ago
r=vidur. A small comment - if we actually do expect flushes to occur at
inopportune moments during regular running of the product, I'd take out the
debug printf.
(Assignee)

Comment 27

17 years ago
Marking rtm+.
Whiteboard: [rtm need info][Fix in Hand] super-reviewed, waiting for review → [rtm+][Fix in Hand] super-reviewed, reviewed
(Assignee)

Comment 28

17 years ago
Checked patches into trunk
Whiteboard: [rtm+][Fix in Hand] super-reviewed, reviewed → [rtm+][Fix in Hand] Checked into trunk, super-reviewed, reviewed

Comment 29

17 years ago
PDT says rtm++, please land on branch ASAP
Whiteboard: [rtm+][Fix in Hand] Checked into trunk, super-reviewed, reviewed → [rtm++][Fix in Hand] Checked into trunk, super-reviewed, reviewed
(Assignee)

Comment 30

17 years ago
Checked fix into branch.
Marking fixed.
Status: ASSIGNED → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → FIXED

Comment 31

17 years ago
Fixed in the Oct 18th branch build (Mac, Windows, and Linux).
Keywords: vtrunk

Comment 32

17 years ago
Verified Fixed on Mozilla trunk builds.  Tested both test cases and original URL
with multiple reloads on linux, win32 and mac.
linux 102608 RedHat 6.2
win32 102604 NT 4
mac 102608 Mac OS9
Setting bug to Verified and removing vtrunk keyword
Status: RESOLVED → VERIFIED
Keywords: vtrunk
You need to log in before you can comment on or make changes to this bug.