56335 - crash in view manager

Status: VERIFIED FIXED

(Core :: Web Painting, defect, P1)

Description

[buster]

test case derived from bug 55880.
the stack below is a different stack than the crash I'm looking into.  May be
the same cause, different symptom, dunno.

nsViewManager2::RenderDisplayListElement(DisplayListElement2 * 0x02bb5030,
nsIRenderingContext & {...}) line 857 + 30 bytes
nsViewManager2::RenderViews(nsIView * 0x02bd6330, nsIRenderingContext & {...},
const nsRect & {...}, int & 0) line 806
nsViewManager2::Refresh(nsIView * 0x02bd6330, nsIRenderingContext * 0x02c326b0,
const nsRect * 0x0012f968, unsigned int 1) line 686
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x02ba84a0, nsGUIEvent *
0x0012faa8, nsEventStatus * 0x0012f9ac) line 1352
HandleEvent(nsGUIEvent * 0x0012faa8) line 68
nsWindow::DispatchEvent(nsWindow * const 0x02bd5734, nsGUIEvent * 0x0012faa8,
nsEventStatus & nsEventStatus_eIgnore) line 682 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012faa8, nsEventStatus &
nsEventStatus_eIgnore) line 708
nsWindow::OnPaint() line 3703 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long *
0x0012fe58) line 2806 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x063a047c, unsigned int 15, unsigned int 0, long
0) line 951 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()

Comment 1

[buster]

keywords, keywords, keywords

Comment 2

[buster]

Attachment: sorta minimized test case. change anything, and the crash seems to go away. sometimes, you need to reload to see the crash

Comment 3

[buster]

crash on WinNT, debug build, code pulled 10:00am today (10/12/00)

Comment 4

[Kevin McCluskey (gone)]

Here is the problem:

The radio button frame inquires what it's current check state is within its
paint method, this causes a flush of pending notifications which destroys the
view sitting in the display list that is being painted.

Here is a stack trace which shows the view is being destroyed from while the
display list is being painted.

nsDebug::Assertion(const char * 0x014e7564, const char * 0x014e7558, const char
* 0x014e7538, int 94) line 256 + 13 bytes
nsView::~nsView() line 94 + 32 bytes
nsView::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsView::Destroy(nsView * const 0x03b777a0) line 270 + 34 bytes
nsFrame::Destroy(nsFrame * const 0x01309a18, nsIPresContext * 0x03426cc0) line 426
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309a18, nsIPresContext *
0x03426cc0) line 99
nsBlockFrame::Destroy(nsBlockFrame * const 0x01309a18, nsIPresContext *
0x03426cc0) line 1233
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309b0c, nsIPresContext *
0x03426cc0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x01309b0c, nsIPresContext * 0x03426cc0)
line 1002 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x013043f0, nsIPresContext *
0x03426cc0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x013043f0, nsIPresContext * 0x03426cc0)
line 1002 + 13 bytes
nsGfxScrollFrame::Destroy(nsGfxScrollFrame * const 0x013043f0, nsIPresContext *
0x03426cc0) line 486
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309948, nsIPresContext *
0x03426cc0) line 98
nsBoxFrame::Destroy(nsBoxFrame * const 0x01309948, nsIPresContext * 0x03426cc0)
line 1002 + 13 bytes
nsGfxTextControlFrame2::Destroy(nsGfxTextControlFrame2 * const 0x01309948,
nsIPresContext * 0x03426cc0) line 1156 + 13 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01304b58, nsIPresContext *
0x03426cc0) line 98
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x013044a8)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x013094cc, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x01304520)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x01303df8, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130924c, nsIPresContext *
0x03426cc0) line 98
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01309080, nsIPresContext *
0x03426cc0) line 98
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x0130903c, nsIPresContext *
0x03426cc0) line 98
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01308fd4, nsIPresContext *
0x03426cc0) line 98
nsTableFrame::Destroy(nsTableFrame * const 0x01308fd4, nsIPresContext *
0x03426cc0) line 269
nsFrameList::DestroyFrames(nsIPresContext * 0x03426cc0) line 36
nsContainerFrame::Destroy(nsContainerFrame * const 0x01308f80, nsIPresContext *
0x03426cc0) line 98
nsTableOuterFrame::Destroy(nsTableOuterFrame * const 0x01308f80, nsIPresContext
* 0x03426cc0) line 64
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x0130460c)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x013045c0, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsLineBox::DeleteLineList(nsIPresContext * 0x03426cc0, nsLineBox * 0x0130465c)
line 252
nsBlockFrame::Destroy(nsBlockFrame * const 0x013cfca8, nsIPresContext *
0x03426cc0) line 1230 + 16 bytes
nsBlockFrame::DoRemoveFrame(nsIPresContext * 0x03426cc0, nsIFrame * 0x013cfca8)
line 5518
nsBlockFrame::RemoveFrame(nsBlockFrame * const 0x013cfc5c, nsIPresContext *
0x03426cc0, nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x013cfca8)
line 5416 + 16 bytes
FrameManager::RemoveFrame(FrameManager * const 0x0340ac30, nsIPresContext *
0x03426cc0, nsIPresShell & {...}, nsIFrame * 0x013cfc5c, nsIAtom * 0x00000000,
nsIFrame * 0x013cfca8) line 729
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x0340b870,
nsIPresContext * 0x03426cc0, nsIContent * 0x03d50d68, nsIContent * 0x034098a8,
int 1) line 9392 + 58 bytes
nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x0340b870,
nsIPresContext * 0x03426cc0, nsIContent * 0x03d50d68, nsIContent * 0x034098a8,
nsIContent * 0x034098a8, int 1) line 8949 + 28 bytes
nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x03426cc0,
nsIFrame * 0x01304314) line 13077 + 47 bytes
nsCSSFrameConstructor::ContentAppended(nsCSSFrameConstructor * const 0x0340b870,
nsIPresContext * 0x03426cc0, nsIContent * 0x034c98c8, int 2) line 8291 + 16 bytes
StyleSetImpl::ContentAppended(StyleSetImpl * const 0x0340b930, nsIPresContext *
0x03426cc0, nsIContent * 0x034c98c8, int 2) line 1138
PresShell::ContentAppended(PresShell * const 0x0340b508, nsIDocument *
0x03d1e7e0, nsIContent * 0x034c98c8, int 2) line 3649 + 46 bytes
nsDocument::ContentAppended(nsDocument * const 0x03d1e7e0, nsIContent *
0x034c98c8, int 2) line 1883
nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x03d1e7e0, nsIContent *
0x034c98c8, int 2) line 1303
HTMLContentSink::NotifyAppend(nsIContent * 0x034c98c8, int 2) line 4440
SinkContext::FlushTags(int 1) line 1981
HTMLContentSink::FlushPendingNotifications(HTMLContentSink * const 0x03d50b10)
line 5145 + 16 bytes
nsHTMLDocument::FlushPendingNotifications(nsHTMLDocument * const 0x03d1e7e0)
line 1372 + 23 bytes
nsGenericHTMLElement::GetPrimaryFrame(nsIHTMLContent * 0x0344ae4c,
nsIFormControlFrame * & 0x00000000, int 1) line 2382
nsHTMLInputElement::GetChecked(nsHTMLInputElement * const 0x0344ae40, int *
0x0012e258) line 473 + 51 bytes
nsFormControlFrame::GetCurrentCheckState(int * 0x0012e258) line 888 + 19 bytes
nsGfxRadioControlFrame::PaintRadioButton(nsIPresContext * 0x03426cc0,
nsIRenderingContext & {...}, const nsRect & {...}) line 279
nsGfxRadioControlFrame::Paint(nsGfxRadioControlFrame * const 0x013097ec,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 329
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013097ec, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsHTMLContainerFrame::Paint(nsHTMLContainerFrame * const 0x01304af8,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 108
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01304af8, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013094cc, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013094cc, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x01303df8, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01303df8, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsTableCellFrame::Paint(nsTableCellFrame * const 0x0130924c, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 366
nsTableRowFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 599
nsTableRowFrame::Paint(nsTableRowFrame * const 0x01309080, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 552
nsTableRowGroupFrame::PaintChildren(nsIPresContext * 0x03426cc0,
nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 273
nsTableRowGroupFrame::Paint(nsTableRowGroupFrame * const 0x0130903c,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 227
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x0130903c, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsTableFrame::Paint(nsTableFrame * const 0x01308fd4, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 1370
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01308fd4, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsTableOuterFrame::Paint(nsTableOuterFrame * const 0x01308f80, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 352
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x01308f80, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013045c0, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013045c0, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013cfca8, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013cfca8, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsBlockFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 6398
nsBlockFrame::Paint(nsBlockFrame * const 0x013cfc5c, nsIPresContext *
0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...}, nsFramePaintLayer
eFramePaintLayer_Overlay) line 6276
nsContainerFrame::PaintChild(nsIPresContext * 0x03426cc0, nsIRenderingContext &
{...}, const nsRect & {...}, nsIFrame * 0x013cfc5c, nsFramePaintLayer
eFramePaintLayer_Overlay) line 211
nsContainerFrame::PaintChildren(nsIPresContext * 0x03426cc0, nsIRenderingContext
& {...}, const nsRect & {...}, nsFramePaintLayer eFramePaintLayer_Overlay) line 155
nsHTMLContainerFrame::Paint(nsHTMLContainerFrame * const 0x013cede4,
nsIPresContext * 0x03426cc0, nsIRenderingContext & {...}, const nsRect & {...},
nsFramePaintLayer eFramePaintLayer_Overlay) line 108
PresShell::Paint(PresShell * const 0x0340b504, nsIView * 0x034c4380,
nsIRenderingContext & {...}, const nsRect & {...}) line 4001 + 34 bytes
nsView::Paint(nsView * const 0x034c4380, nsIRenderingContext & {...}, const
nsRect & {...}, unsigned int 128, int & 268600245) line 291
nsViewManager2::RenderDisplayListElement(DisplayListElement2 * 0x03b96f60,
nsIRenderingContext & {...}) line 865
nsViewManager2::RenderViews(nsIView * 0x034c6310, nsIRenderingContext & {...},
const nsRect & {...}, int & 0) line 810
nsViewManager2::Refresh(nsIView * 0x034c6310, nsIRenderingContext * 0x03be0630,
const nsRect * 0x0012f6f8, unsigned int 1) line 689
nsViewManager2::DispatchEvent(nsViewManager2 * const 0x0340bd70, nsGUIEvent *
0x0012f838, nsEventStatus * 0x0012f73c) line 1358
HandleEvent(nsGUIEvent * 0x0012f838) line 68
nsWindow::DispatchEvent(nsWindow * const 0x034c10f4, nsGUIEvent * 0x0012f838,
nsEventStatus & nsEventStatus_eIgnore) line 681 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f838, nsEventStatus &
nsEventStatus_eIgnore) line 707
nsWindow::OnPaint() line 3698 + 28 bytes
nsWindow::ProcessMessage(unsigned int 15, unsigned int 0, long 0, long *
0x0012fbe8) line 2805 + 17 bytes
nsWindow::WindowProc(HWND__ * 0x016b04d6, unsigned int 15, unsigned int 0, long
0) line 950 + 27 bytes
USER32! 77e719d0()
USER32! 77e71982()
NTDLL! 77f763a3()

Comment 5

[Kevin McCluskey (gone)]

Marking [rtm need info]

I talked with buster and we came up with the following proposal for a fix:

Add a new method nsIViewManager which returns whether the viewmanager is
currently painting.

Add logic to NS_IMETHODIMP nsHTMLDocument::FlushPendingNotifications() to cycle
through the presshells asking their viewmanagers if their painting.

If any of the viewmanagers are currently painting then return immediately
without flushing the pending notifications.

Vidur: is this an acceptable solution?

Comment 6

[buster]

Attachment: A somewhat more minimized test case, still very sensitive to any changes to the markup. The key seems to be the combination of the input element and the script at the end of the file that resolves to a document.write

Comment 7

[Kevin McCluskey (gone)]

Attachment: viewmanager patch which adds IsPainting method

Comment 8

[Kevin McCluskey (gone)]

Attachment: nsHTMLDocument patch which ignores pending update flush if view manager is painting

Comment 9

[Kevin McCluskey (gone)]

The two patches I attached stop the crashing for all of the test cases in this
bug. They also fix the crash in bug 55880.

Comment 10

[buster]

pres shells are ref counted, so you're leaking here:

nsIPresShell* shell = (nsIPresShell*) mPresShells.ElementAt(i);

you should change this to an nsCOMPtr.

You should probably fix whereever you copied this code from, too!

Pending this fix and vidur's review, a=buster

Comment 11

[Kevin McCluskey (gone)]

mPresShells is a void array, so its not refcounted.

Comment 12

[Kevin McCluskey (gone)]

Attachment: Cleaned up nsHTMLDocument patch. Added NS_STATIC and NS_SUCCEEDED.

Comment 13

[Kevin McCluskey (gone)]

Attachment: Viewmanager patch which includes both viewmanager and viewmanager2

Comment 14

[Kevin McCluskey (gone)]

Added [Fix in Hand] super-reviewed, waiting for review to status

Comment 15

[Kevin McCluskey (gone)]

CC'ing Johnny.

Comment 16

[Kevin McCluskey (gone)]

Added top100, patch keywords

This bug is fairly serious.  It can cause random crashes on pages with form
elements. The URL in this bug crashes consistently, but other pages with form
elements may or may not crash depending on speed of the machine or network
connection. It all depends on what is sitting in pending reflow event queue when
the form elements are painting.

The patch'es prevent the processing of pending events while painting. The
pending events are NOT discarded, they will be processed after painting has
completed. The current behavior of processing the pending event during painting
is purely a undesirable side-effect of getting the current state for the form
element.

Comment 17

[buster]

what about nsDocument::FlushPendingNotifications()?  It will get called by
nsXMLDocument, for example.  It's also possible for someone to call
nsIPresShell::FlushPendingNotifications() directly, rather than going through
the document.  I don't know if this happens anywhere, but it is part of the
public interface.

Comment 18

[vidur (gone)]

My suggestion to Kevin was that the test for nsIViewManager::IsPainting should
move to nsPresShell::FlushPendingNotifications. We already have a reentrancy
check in the latter to see if we're reflowing. Checking whether we're painting
as well is a logical addition. Kevin plans to repost a patch.

Comment 19

[Kevin McCluskey (gone)]

It doesn't work if I move the logic to nsPresShell::FlushPendingNotifications.

The reason is:

the sink->FlushPendingNotifications() call in 
nsHTMLDocument::FlushPendingNotifications() results in destruction of frames and 
their associated views. The current patch works because it prevents both the 
flushing of the sink and nsPresShell.

Comment 20

[Kevin McCluskey (gone)]

Attachment: patch file with modifications to layout (nsHTMLDocument + nsPresShell)

Comment 21

[Kevin McCluskey (gone)]

Attachment: layout patch file with debug output when unsafe flush occurs

Comment 22

[buster]

*** Bug 55880 has been marked as a duplicate of this bug. ***

Comment 23

[Kevin McCluskey (gone)]

Attachment: Improved layout patch that prevents the sink from flushing if reflowing or painting

Comment 24

[Syd Logan]

Applied the patches on Linux. Seems ok to me, IM and Chat worked fine in commercial.

Comment 25

[buster]

re-affirming sr=buster for the latest patch (10/13/00 18:13).
Please verify www.intel.com before checking this in.  In an earlier patch, I saw
some incomplete reflow problems that *may* have been related, but may not have
been.  I just want independent confirmation from kevin or anyone else who has
applied the patch that either www.intel.com lays out correctly with this change,
or that any problems on that page are unrelated to this change.

Comment 26

[vidur (gone)]

r=vidur. A small comment - if we actually do expect flushes to occur at
inopportune moments during regular running of the product, I'd take out the
debug printf.

Comment 27

[Kevin McCluskey (gone)]

Marking rtm+.

Comment 28

[Kevin McCluskey (gone)]

Checked patches into trunk

Comment 29

[Peter Trudelle]

PDT says rtm++, please land on branch ASAP

Comment 30

[Kevin McCluskey (gone)]

Checked fix into branch.
Marking fixed.

Comment 31

[Chris Petersen]

Fixed in the Oct 18th branch build (Mac, Windows, and Linux).

Comment 32

[Asa Dotzler [:asa]]

Verified Fixed on Mozilla trunk builds.  Tested both test cases and original URL
with multiple reloads on linux, win32 and mac.
linux 102608 RedHat 6.2
win32 102604 NT 4
mac 102608 Mac OS9
Setting bug to Verified and removing vtrunk keyword