77779 - Crash when set up a "User Defined" font on windows

Status: VERIFIED WORKSFORME

(Core :: Internationalization, defect)

Description

[Yuying Long]

Build: 04-25 trunk Win32 build

Steps to reproduce:
1. Launch browser, Pregerences | Appearance | Fonts.
2. User Defined, select fonts, e.g. Japanese | MSGothic and Chinese | MingLiu...
   for Serif, Sans Serif and Fixed-width fonts.
3. Click "OK".

Result:
Crash on both WinME-Ja and Win2k-Simp. Chinese

Not reproduce on: N6.01 and 04-25 Mac and Linux build, however Mac has a problem 
with display pages after set up User Defined fond, I'll file a seperate bug for 
that.

Comment 1

[Yuying Long]

Mac bug 77786

Comment 2

[nhottanscp]

talkback?

Comment 3

[Yuying Long]

ID 29669638
Call Stack:    (Signature = 0x03f9f7aa 1e983c01)  
     0x03f9f7aa    
     0x52005500    
 

Comment 4

[nhottanscp]

Call stack from my debug builded (pulled this morning).

nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012f700) line 32 + 
23 bytes
nsCOMPtr<nsIDOMEventReceiver>::assign_from_helper(const nsCOMPtr_helper & {...}, 
const nsID & {...}) line 974 + 18 bytes
nsCOMPtr<nsIDOMEventReceiver>::nsCOMPtr<nsIDOMEventReceiver>(const 
nsQueryInterface & {...}) line 568
nsXBLBinding::ExecuteAttachedHandler(nsXBLBinding * const 0x048ada30) line 1357
nsBindingManager::ProcessAttachedQueue(nsBindingManager * const 0x04253bf0) line 
955
nsCSSFrameConstructor::CreateTreeWidgetContent(nsCSSFrameConstructor * const 
0x0427b4b0, nsIPresContext * 0x0424b4d0, nsIFrame * 0x02bba5d8, nsIFrame * 
0x00000000, nsIContent * 0x04937f10, nsIFrame * * 0x02bba670, int 1, int 0, 
nsILayoutHistoryState * 0x00000000) line 12342
nsXULTreeGroupFrame::GetFirstTreeBox(int * 0x0012fa0c) line 304
nsTreeLayout::LazyRowCreator(nsTreeLayout * const 0x048af570, nsBoxLayoutState & 
{...}, nsXULTreeGroupFrame * 0x02bba5d8) line 342 + 12 bytes
nsXULTreeOuterGroupFrame::ReflowFinished(nsXULTreeOuterGroupFrame * const 
0x02bba694, nsIPresShell * 0x0427b110, int * 0x0012faa0) line 1323
PresShell::HandlePostedReflowCallbacks() line 4637
PresShell::ProcessReflowCommands(int 1) line 5824
ReflowEvent::HandleEvent() line 5608
HandlePLEvent(ReflowEvent * 0x0427da00) line 5622
PL_HandleEvent(PLEvent * 0x0427da00) line 588 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00539290) line 518 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x006c0588, unsigned int 49374, unsigned int 0, 
long 5477008) line 1069 + 9 bytes
USER32! 77e148dc()
USER32! 77e14aa7()
USER32! 77e266fd()
nsAppShellService::Run(nsAppShellService * const 0x00540120) line 408
main1(int 1, char * * 0x00484380, nsISupports * 0x00000000) line 1005 + 32 bytes
main(int 1, char * * 0x00484380) line 1300 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e992a6()

Comment 5

[nhottanscp]

Crashes around tree widget code, reassign to hyatt.

Comment 6

[Andreas Becker]

Adding keyword intl.

Comment 7

[Jaime Rodriguez, Jr.]

This is crasher. Request it be fixed. Adding nsbeta1 keyword. Please assign
M0.9.1 milestone.

Does this crasher prevent testing of the feature?

Comment 8

[Fabian Guisset]

*** Bug 79378 has been marked as a duplicate of this bug. ***

Comment 9

[Boris Zbarsky [:bzbarsky]]

os=all based on dup

Comment 10

[John Morrison]

*** Bug 79902 has been marked as a duplicate of this bug. ***

Comment 11

[Jaime Rodriguez, Jr.]

Hyatt - This is a crasher, should it be done before M1.0? Request it be fixed 
for M0.9.1, because a crasher is a beta stopper.

Comment 12

[nhottanscp]

ylong, can you still reproduce this?

Comment 13

[Yuying Long]

Not reproducible on 05-15 trunk build.  Mark it as wonkforme for now.

Comment 14

[Yuying Long]

Verified.

Comment 15

[kill this account]

I suspect that we have a memory corruption problem that makes the crash
happen erratically.

The fact that it does not happend all the time does not mean it is not there
(just @#$% hard to debug or verify).