Closed Bug 830299 Opened 11 years ago Closed 11 years ago

Crash in settings app (or, with crash worked around, missing header)

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
21 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla21
Project Flags:
blocking-b2g -
Tracking Flags:
Tracking Status
firefox18 --- unaffected
firefox19 --- unaffected
firefox20 --- unaffected
firefox21 + fixed
b2g18 --- unaffected

People

(Reporter: cyu, Assigned: cyu)

References

Details

(Keywords: crash, regression, Whiteboard: [b2g-crash][triage:1/16][shadow:dholbert])

Crash Data

Attachments

(4 files)

Add check for scrollcorner in nsGfxScrollFrameInner::ReloadChildFrames().
1.02 KB, patch
roc
: review+
Details | Diff | Splinter Review
simple testcase for crash
828 bytes, text/html; charset=UTF-8
Details
Navigation bar disappears.
35.26 KB, image/png
Details
Return content insertion frame as fixed containing block
994 bytes, text/plain
Details 
Using the latest trunk, the settings app crash on entering submenus (e.g. Internet Sharing)

Crash stack:
Program received signal SIGSEGV, Segmentation fault.
0x40619c54 in nsFrame::BoxReflow (this=0x432e6b10, aState=<value optimized out>, aPresContext=<value optimized out>, aDesiredSize=..., aRenderingContext=0x444bb070, aX=19200, aY=27600, aWidth=0, aHeight=0, a
MoveFrame=true) at /home/cervantes/hg/mozilla-central/layout/generic/nsFrame.cpp:8010
8010        if (metrics->mLastSize.width != aWidth) {
(gdb) bt
#0  0x40619c54 in nsFrame::BoxReflow (this=0x432e6b10, aState=<value optimized out>, aPresContext=<value optimized out>, aDesiredSize=..., aRenderingContext=0x444bb070, aX=19200, aY=27600, aWidth=0, aHeight=
0, aMoveFrame=true) at /home/cervantes/hg/mozilla-central/layout/generic/nsFrame.cpp:8010
#1  0x40626daa in nsFrame::DoLayout (this=0x432e6b10, aState=...) at /home/cervantes/hg/mozilla-central/layout/generic/nsFrame.cpp:7776
#2  0x4071212e in nsIFrame::Layout (this=0x432e6b10, aState=...) at /home/cervantes/hg/mozilla-central/layout/xul/base/src/nsBox.cpp:510
#3  0x40712958 in nsBoxFrame::LayoutChildAt (aState=..., aBox=0x432e6b10, aRect=...) at /home/cervantes/hg/mozilla-central/layout/xul/base/src/nsBoxFrame.cpp:1928
#4  0x4062d1ba in nsGfxScrollFrameInner::LayoutScrollbars (this=0x44d87060, aState=..., aContentArea=..., aOldScrollArea=<value optimized out>) at /home/cervantes/hg/mozilla-central/layout/generic/nsGfxScrol
lFrame.cpp:3538
#5  0x40630804 in nsHTMLScrollFrame::Reflow (this=0x44d87010, aPresContext=<value optimized out>, aDesiredSize=..., aReflowState=..., aStatus=@0xbead2900) at /home/cervantes/hg/mozilla-central/layout/generic
/nsGfxScrollFrame.cpp:811
#6  0x405fd0ee in nsAbsoluteContainingBlock::ReflowAbsoluteFrame (this=<value optimized out>, aDelegatingFrame=<value optimized out>, aPresContext=<value optimized out>, aReflowState=..., aContainingBlockWid
th=19200, aContainingBlockHeight=27600, aConstrainHeight=true, aKidFrame=0x44d87010, aStatus=@0xbead2900, aOverflowAreas=0xbead2cec) at /home/cervantes/hg/mozilla-central/layout/generic/nsAbsoluteContainingB
lock.cpp:405
#7  0x405fd8a0 in nsAbsoluteContainingBlock::Reflow (this=<value optimized out>, aDelegatingFrame=0x444d4758, aPresContext=0x444f2400, aReflowState=..., aReflowStatus=@0xbead2c84, aContainingBlockWidth=19200
, aContainingBlockHeight=27600, aConstrainHeight=true, aCBWidthChanged=true, aCBHeightChanged=true, aOverflowAreas=0xbead2cec) at /home/cervantes/hg/mozilla-central/layout/generic/nsAbsoluteContainingBlock.c
pp:125
#8  0x4061ca70 in nsFrame::ReflowAbsoluteFrames (this=0x444d4758, aPresContext=0x444f2400, aDesiredSize=<value optimized out>, aReflowState=..., aStatus=@0xbead2c84) at /home/cervantes/hg/mozilla-central/lay
out/generic/nsFrame.cpp:4255
#9  0x40626428 in nsFrame::FinishReflowWithAbsoluteFrames (this=0x1, aPresContext=0x0, aDesiredSize=..., aReflowState=..., aStatus=@0xbead2c84) at /home/cervantes/hg/mozilla-central/layout/generic/nsFrame.cp
p:4224
#10 0x40634f60 in nsCanvasFrame::Reflow (this=0x444d4758, aPresContext=0x444f2400, aDesiredSize=..., aReflowState=..., aStatus=@0xbead2c84) at /home/cervantes/hg/mozilla-central/layout/generic/nsCanvasFrame.
cpp:556
#11 0x4061215a in nsContainerFrame::ReflowChild (this=<value optimized out>, aKidFrame=0x444d4758, aPresContext=0x444f2400, aDesiredSize=..., aReflowState=..., aX=0, aY=0, aFlags=3, aStatus=@0xbead2c84, aTra
cker=0x0) at /home/cervantes/hg/mozilla-central/layout/generic/nsContainerFrame.cpp:954
#12 0x4062feb0 in nsHTMLScrollFrame::ReflowScrolledFrame (this=0x444d4930, aState=0xbead2d8c, aAssumeHScroll=<value optimized out>, aAssumeVScroll=<value optimized out>, aMetrics=0xbead2cc0, aFirstPass=true)
 at /home/cervantes/hg/mozilla-central/layout/generic/nsGfxScrollFrame.cpp:435
#13 0x4063020c in nsHTMLScrollFrame::ReflowContents (this=0x444d4930, aState=0xbead2d8c, aDesiredSize=<value optimized out>) at /home/cervantes/hg/mozilla-central/layout/generic/nsGfxScrollFrame.cpp:533
#14 0x40630684 in nsHTMLScrollFrame::Reflow (this=0x444d4930, aPresContext=<value optimized out>, aDesiredSize=..., aReflowState=..., aStatus=@0xbead32cc) at /home/cervantes/hg/mozilla-central/layout/generic
/nsGfxScrollFrame.cpp:774
#15 0x4061215a in nsContainerFrame::ReflowChild (this=<value optimized out>, aKidFrame=0x444d4930, aPresContext=0x444f2400, aDesiredSize=..., aReflowState=..., aX=0, aY=0, aFlags=0, aStatus=@0xbead32cc, aTra
cker=0x0) at /home/cervantes/hg/mozilla-central/layout/generic/nsContainerFrame.cpp:954
#16 0x4066d872 in ViewportFrame::Reflow (this=0x444d4298, aPresContext=0x444f2400, aDesiredSize=..., aReflowState=..., aStatus=@0xbead32cc) at /home/cervantes/hg/mozilla-central/layout/generic/nsViewportFram
e.cpp:203
#17 0x405dcf88 in PresShell::DoReflow (this=0x431fc1b0, target=Cannot access memory at address 0x0
) at /home/cervantes/hg/mozilla-central/layout/base/nsPresShell.cpp:7567
#18 0x405dd958 in PresShell::ProcessReflowCommands (this=0x431fc1b0, aInterruptible=false) at /home/cervantes/hg/mozilla-central/layout/base/nsPresShell.cpp:7708
#19 0x405dde16 in PresShell::FlushPendingNotifications (this=0x431fc1b0, aFlush=...) at /home/cervantes/hg/mozilla-central/layout/base/nsPresShell.cpp:3906
#20 0x405ccb84 in PresShell::FlushPendingNotifications (this=0x1, aType=<value optimized out>) at /home/cervantes/hg/mozilla-central/layout/base/nsPresShell.cpp:3756
#21 0x407a0b9e in nsDocument::FlushPendingNotifications (this=0x444f1000, aType=Flush_Layout) at /home/cervantes/hg/mozilla-central/content/base/src/nsDocument.cpp:6786
#22 0x4099f2b6 in nsGlobalWindow::FlushPendingNotifications (this=<value optimized out>, aType=Flush_Layout) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:10443
#23 0x409a6586 in nsGlobalWindow::GetScrollXY (this=0x1, aScrollX=0xbead3858, aScrollY=0x0, aDoFlush=true) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4342
#24 0x409a65c0 in nsGlobalWindow::GetScrollXY (this=0x440d1190, aScrollX=0xbead3858, aScrollY=0x0, aDoFlush=false) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4356
#25 0x409a65c0 in nsGlobalWindow::GetScrollXY (this=0x440d1d30, aScrollX=0xbead3858, aScrollY=0x0, aDoFlush=false) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4356
#26 0x409a6662 in nsGlobalWindow::GetScrollX (this=0x1, aScrollX=0x0) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4374
#27 0x412259aa in NS_InvokeByIndex_P (that=0x440d1d30, methodIndex=50, paramCount=<value optimized out>, params=<value optimized out>) at /home/cervantes/hg/mozilla-central/xpcom/reflect/xptcall/src/md/unix/
xptcinvoke_arm.cpp:160
#28 0x40d1df76 in CallMethodHelper::Invoke (this=0xbead3830) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:3085
#29 CallMethodHelper::Call (this=0xbead3830) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:2419
#30 0x40d1fd06 in XPCWrappedNative::CallMethod (ccx=..., mode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:2385
#31 0x40d2644a in XPCWrappedNative::GetAttribute (cx=<value optimized out>, argc=0, vp=0x434a40a0) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/xpcprivate.h:2814
#32 XPC_WN_GetterSetter (cx=<value optimized out>, argc=0, vp=0x434a40a0) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1536
#33 0x41545234 in js::CallJSNative (cx=0x4267ef20, native=0x40d26305 <XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/cervantes/hg/mozilla-central/js/src/jscntxtinlines.h:378
#34 0x41551e1a in js::InvokeKernel (cx=0x4267ef20, args=..., construct=js::NO_CONSTRUCT) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:391
#35 0x415526b8 in Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0x0, rval=0xbead3c78) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.h:112
#36 js::Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0x0, rval=0xbead3c78) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:439
#37 0x41552788 in js::InvokeGetterOrSetter (cx=0x1, obj=0x43f3c040, fval=..., argc=1079997173, argv=0x0, rval=0xbead3c78) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:512
#38 0x41571684 in js::Shape::get (cx=0x4267ef20, receiver=..., obj=<value optimized out>, pobj=..., shape=..., getHow=0, vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsscopeinlines.h:296
#39 js_NativeGetInline (cx=0x4267ef20, receiver=..., obj=<value optimized out>, pobj=..., shape=..., getHow=0, vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobj.cpp:3408
#40 0x4157192c in js_GetPropertyHelperInline (cx=0x4267ef20, obj=..., receiver=..., id=..., vp=..., getHow=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsobj.cpp:3561
#41 0x41571da2 in GetProperty (cx=0x1, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobj.cpp:3577
#42 0x4148f21e in JSObject::getGeneric (cx=0x1, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobjinlines.h:174
#43 0x415a5434 in js::DirectProxyHandler::get (this=<value optimized out>, cx=0x4267ef20, proxy=<value optimized out>, receiver_=<value optimized out>, id_=..., vp=0xbead3f68) at /home/cervantes/hg/mozilla-central/js/src/jsproxy.cpp:565
#44 0x41627d3e in js::Wrapper::get (this=0x41fc8eb4, cx=0x4267ef20, wrapper=0x43f3c040, receiver=0x43f3c040, id=..., vp=0xbead3f68) at /home/cervantes/hg/mozilla-central/js/src/jswrapper.cpp:266
#45 0x409ad4ec in nsOuterWindowProxy::get (this=0x41fc8eb4, cx=0x4267ef20, wrapper=0x43f3c040, receiver=0x43f3c040, id=..., vp=0xbead3f68) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:574
#46 0x415a797c in js::Proxy::get (cx=0x4267ef20, proxy=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsproxy.cpp:2367
#47 0x415a7a4a in proxy_GetGeneric (cx=0x1, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsproxy.cpp:2633
#48 0x4148f20e in JSObject::getGeneric (cx=0x1, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobjinlines.h:171
#49 0x4154b254 in GetPropertyGenericMaybeCallXML (cx=0x4267ef20, entryFrame=<value optimized out>, interpMode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsinterpinlines.h:215
#50 GetPropertyOperation (cx=0x4267ef20, entryFrame=<value optimized out>, interpMode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsinterpinlines.h:287
#51 js::Interpret (cx=0x4267ef20, entryFrame=<value optimized out>, interpMode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:2235
#52 0x41551678 in js::RunScript (cx=0x4267ef20, script=..., fp=0x434a4040) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:348
#53 0x41551e5c in js::InvokeKernel (cx=0x4267ef20, args=..., construct=js::NO_CONSTRUCT) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:406
#54 0x415526b8 in Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0xbead46f8, rval=0xbead4848) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.h:112
#55 js::Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0xbead46f8, rval=0xbead4848) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:439
#56 0x4149473a in JS_CallFunctionValue (cx=0x4267ef20, objArg=0x43f3c040, fval=..., argc=1, argv=0xbead46f8, rval=0xbead4848) at /home/cervantes/hg/mozilla-central/js/src/jsapi.cpp:5829
#57 0x40d1ade8 in nsXPCWrappedJSClass::CallMethod (this=0x444805b0, wrapper=<value optimized out>, methodIndex=<value optimized out>, info_=0x431b8088, nativeParams=0xbead4930) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedJSClass.cpp:1432
#58 0x40d14f9a in nsXPCWrappedJS::CallMethod (this=0x426043c0, methodIndex=3, info=0x431b8088, params=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedJS.cpp:580
#59 0x4122638a in PrepareAndDispatch (self=<value optimized out>, methodIndex=<value optimized out>, args=0xbead49ec) at /home/cervantes/hg/mozilla-central/xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:105  
#60 0x412259c0 in SharedStub () from /home/cervantes/git/b2g-device2/B2G/objdir-gecko-dbg/dist/bin/libxul.so
#61 0x40849822 in nsEventListenerManager::HandleEventSubType (this=<value optimized out>, aListenerStruct=<value optimized out>, aListener=0x444cf500, aDOMEvent=0x44b963ac, aCurrentTarget=0x440d1d98, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventListenerManager.cpp:922
#62 0x408499ca in nsEventListenerManager::HandleEventInternal (this=0x444d6150, aPresContext=<value optimized out>, aEvent=0x44b95a00, aDOMEvent=0xbead4b54, aCurrentTarget=0x440d1d98, aEventStatus=0xbead4b58, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventListenerManager.cpp:989
#63 0x40860a8a in nsEventListenerManager::HandleEvent (this=<value optimized out>, aVisitor=..., aMayHaveNewListenerManagers=<value optimized out>, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventListenerManager.h:279
#64 nsEventTargetChainItem::HandleEvent (this=<value optimized out>, aVisitor=..., aMayHaveNewListenerManagers=<value optimized out>, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:183
#65 0x40860c14 in nsEventTargetChainItem::HandleEventTargetChain (this=<value optimized out>, aVisitor=..., aCallback=0x0, aMayHaveNewListenerManagers=<value optimized out>, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:313
#66 0x40861724 in nsEventDispatcher::Dispatch (aTarget=<value optimized out>, aPresContext=0x444f2400, aEvent=0x44b95a00, aDOMEvent=<value optimized out>, aEventStatus=0xbead4bf0, aCallback=0x0, aTargets=0x0) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:681
#67 0x40861914 in nsEventDispatcher::DispatchDOMEvent (aTarget=0x440d1190, aEvent=0x44b95a00, aDOMEvent=0x44b963ac, aPresContext=0x444f2400, aEventStatus=0xbead4bf0) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:742
#68 0x409a94a6 in nsGlobalWindow::DispatchEvent (this=0x440d1d30, aEvent=0x44b963ac, aRetVal=0xbead4c57) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:7557
#69 0x409a851a in nsGlobalWindow::FireHashchange (this=0x440d1d30, aOldURL=..., aNewURL=<value optimized out>) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:8147
#70 0x409a85ce in HashchangeCallback::Run (this=0x44e234f0) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:8073
#71 0x4120bc32 in nsThread::ProcessNextEvent (this=0x42607240, mayWait=<value optimized out>, result=0xbead4cff) at /home/cervantes/hg/mozilla-central/xpcom/threads/nsThread.cpp:627
#72 0x411d39d0 in NS_ProcessNextEvent_P (thread=0x1, mayWait=false) at /home/cervantes/git/b2g-device2/B2G/objdir-gecko-dbg/xpcom/build/nsThreadUtils.cpp:238
#73 0x40fbfc12 in mozilla::ipc::MessagePump::Run (this=0x426022e0, aDelegate=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/glue/MessagePump.cpp:82
#74 0x40fbfd9a in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x426022e0, aDelegate=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/glue/MessagePump.cpp:231
#75 0x41241c8e in MessageLoop::RunInternal (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:215
#76 0x41241cee in MessageLoop::RunHandler (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:208
#77 MessageLoop::Run (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:182
#78 0x40efe232 in nsBaseAppShell::Run (this=0x432f4e80) at /home/cervantes/hg/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:163
#79 0x403ef82e in XRE_RunAppShell () at /home/cervantes/hg/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:656
#80 0x40fbfd04 in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x426022e0, aDelegate=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/glue/MessagePump.cpp:198
#81 0x41241c8e in MessageLoop::RunInternal (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:215
#82 0x41241cee in MessageLoop::RunHandler (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:208
#83 MessageLoop::Run (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:182
#84 0x403f0142 in XRE_InitChildProcess (aArgc=2, aArgv=0xbead5904, aProcess=1113769984) at /home/cervantes/hg/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:494
#85 0x00008540 in main (argc=7, argv=0xbead5974) at /home/cervantes/hg/mozilla-central/ipc/app/MozillaRuntimeMain.cpp:48
(gdb) fr 4
#4  0x4062d1ba in nsGfxScrollFrameInner::LayoutScrollbars (this=0x44d87060, aState=..., aContentArea=..., aOldScrollArea=<value optimized out>) at /home/cervantes/hg/mozilla-central/layout/generic/nsGfxScrollFrame.cpp:3538
3538          nsBoxFrame::LayoutChildAt(aState, mScrollCornerBox, r);
(gdb) p mScrollCornerBox
$2 = (struct nsIFrame *) 0x432e6b10

On b18, mScrollCornerBox is null.
nsGfxScrollFrameInner::mScrollCornerBox is assigned in:

#0  nsGfxScrollFrameInner::ReloadChildFrames (this=0x44d87060) at /home/cervantes/hg/mozilla-central/layout/generic/nsGfxScrollFrame.cpp:2554
#1  0x40630ab0 in nsHTMLScrollFrame::AppendFrames (this=0x44d87010, aListID=<value optimized out>, aFrameList=...) at /home/cervantes/hg/mozilla-central/layout/generic/nsGfxScrollFrame.cpp:115
#2  0x405b6c18 in nsFrameManager::AppendFrames (this=<value optimized out>, aParentFrame=0x44d87010, aListID=mozilla::layout::kAbsoluteList, aFrameList=...) at /home/cervantes/hg/mozilla-central/layout/base/
nsFrameManager.cpp:446
#3  0x4058104e in nsFrameConstructorState::ProcessFrameInsertions (this=0xbead2fc0, aFrameItems=..., aChildListID=mozilla::layout::kAbsoluteList) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameC
onstructor.cpp:1286
#4  0x40584a66 in ~nsFrameConstructorState (this=0xbead2fc0, __in_chrg=<value optimized out>) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:996
#5  0x4058db20 in nsCSSFrameConstructor::ContentAppended (this=0x419cb358, aContainer=0x44b161f0, aFirstNewContent=0x44cfaab0, aAllowLazyConstruction=<value optimized out>) at /home/cervantes/hg/mozilla-cent
ral/layout/base/nsCSSFrameConstructor.cpp:6797
#6  0x4058dcce in nsCSSFrameConstructor::CreateNeededFrames (this=<value optimized out>, aContent=0x44b161f0) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:6387
#7  0x4058dd04 in nsCSSFrameConstructor::CreateNeededFrames (this=<value optimized out>, aContent=0x44e638d0) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:6397
#8  0x4058dd04 in nsCSSFrameConstructor::CreateNeededFrames (this=<value optimized out>, aContent=0x44e1b340) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:6397
#9  0x4058dda6 in nsCSSFrameConstructor::CreateNeededFrames (this=0x444a0000) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:6412
#10 0x405ddd6c in PresShell::FlushPendingNotifications (this=0x431fc1b0, aFlush=...) at /home/cervantes/hg/mozilla-central/layout/base/nsPresShell.cpp:3866
#11 0x405ccb84 in PresShell::FlushPendingNotifications (this=0x0, aType=<value optimized out>) at /home/cervantes/hg/mozilla-central/layout/base/nsPresShell.cpp:3756
#12 0x407a0b9e in nsDocument::FlushPendingNotifications (this=0x444f1000, aType=Flush_Layout) at /home/cervantes/hg/mozilla-central/content/base/src/nsDocument.cpp:6786
#13 0x4099f2b6 in nsGlobalWindow::FlushPendingNotifications (this=<value optimized out>, aType=Flush_Layout) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:10443
#14 0x409a6586 in nsGlobalWindow::GetScrollXY (this=0x0, aScrollX=0xbead3858, aScrollY=0x0, aDoFlush=true) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4342
#15 0x409a65c0 in nsGlobalWindow::GetScrollXY (this=0x440d1190, aScrollX=0xbead3858, aScrollY=0x0, aDoFlush=false) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4356
#16 0x409a65c0 in nsGlobalWindow::GetScrollXY (this=0x440d1d30, aScrollX=0xbead3858, aScrollY=0x0, aDoFlush=false) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4356
#17 0x409a6662 in nsGlobalWindow::GetScrollX (this=0x0, aScrollX=0x1) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:4374
#18 0x412259aa in NS_InvokeByIndex_P (that=0x440d1d30, methodIndex=50, paramCount=<value optimized out>, params=<value optimized out>) at /home/cervantes/hg/mozilla-central/xpcom/reflect/xptcall/src/md/unix/
xptcinvoke_arm.cpp:160
#19 0x40d1df76 in CallMethodHelper::Invoke (this=0xbead3830) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:3085
#20 CallMethodHelper::Call (this=0xbead3830) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:2419
#21 0x40d1fd06 in XPCWrappedNative::CallMethod (ccx=..., mode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:2385
#22 0x40d2644a in XPCWrappedNative::GetAttribute (cx=<value optimized out>, argc=0, vp=0x434a40a0) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/xpcprivate.h:2814
#23 XPC_WN_GetterSetter (cx=<value optimized out>, argc=0, vp=0x434a40a0) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1536
#24 0x41545234 in js::CallJSNative (cx=0x4267ef20, native=0x40d26305 <XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/cervantes/hg/mozilla-central/js/src/jscntxtinlines.h:378
#25 0x41551e1a in js::InvokeKernel (cx=0x4267ef20, args=..., construct=js::NO_CONSTRUCT) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:391
#26 0x415526b8 in Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0x0, rval=0xbead3c78) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.h:112
#27 js::Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0x0, rval=0xbead3c78) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:439
#28 0x41552788 in js::InvokeGetterOrSetter (cx=0x0, obj=0x43f3c040, fval=..., argc=0, argv=0x0, rval=0xbead3c78) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:512
#29 0x41571684 in js::Shape::get (cx=0x4267ef20, receiver=..., obj=<value optimized out>, pobj=..., shape=..., getHow=0, vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsscopeinlines.h:296
#30 js_NativeGetInline (cx=0x4267ef20, receiver=..., obj=<value optimized out>, pobj=..., shape=..., getHow=0, vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobj.cpp:3408
#31 0x4157192c in js_GetPropertyHelperInline (cx=0x4267ef20, obj=..., receiver=..., id=..., vp=..., getHow=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsobj.cpp:3561
#32 0x41571da2 in GetProperty (cx=0x0, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobj.cpp:3577
#33 0x4148f21e in JSObject::getGeneric (cx=0x0, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobjinlines.h:174
#34 0x415a5434 in js::DirectProxyHandler::get (this=<value optimized out>, cx=0x4267ef20, proxy=<value optimized out>, receiver_=<value optimized out>, id_=..., vp=0xbead3f68) at /home/cervantes/hg/mozilla-c
entral/js/src/jsproxy.cpp:565
#35 0x41627d3e in js::Wrapper::get (this=0x41fc8eb4, cx=0x4267ef20, wrapper=0x43f3c040, receiver=0x43f3c040, id=..., vp=0xbead3f68) at /home/cervantes/hg/mozilla-central/js/src/jswrapper.cpp:266
#36 0x409ad4ec in nsOuterWindowProxy::get (this=0x41fc8eb4, cx=0x4267ef20, wrapper=0x43f3c040, receiver=0x43f3c040, id=..., vp=0xbead3f68) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:57
4
#37 0x415a797c in js::Proxy::get (cx=0x4267ef20, proxy=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsproxy.cpp:2367
#38 0x415a7a4a in proxy_GetGeneric (cx=0x0, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsproxy.cpp:2633
#39 0x4148f20e in JSObject::getGeneric (cx=0x0, obj=..., receiver=..., id=..., vp=...) at /home/cervantes/hg/mozilla-central/js/src/jsobjinlines.h:171
#40 0x4154b254 in GetPropertyGenericMaybeCallXML (cx=0x4267ef20, entryFrame=<value optimized out>, interpMode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsinterpinlines.h:215
#41 GetPropertyOperation (cx=0x4267ef20, entryFrame=<value optimized out>, interpMode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsinterpinlines.h:287
#42 js::Interpret (cx=0x4267ef20, entryFrame=<value optimized out>, interpMode=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:2235
#43 0x41551678 in js::RunScript (cx=0x4267ef20, script=..., fp=0x434a4040) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:348
#44 0x41551e5c in js::InvokeKernel (cx=0x4267ef20, args=..., construct=js::NO_CONSTRUCT) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:406
#45 0x415526b8 in Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0xbead46f8, rval=0xbead4848) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.h:112
#46 js::Invoke (cx=0x4267ef20, thisv=..., fval=..., argc=<value optimized out>, argv=0xbead46f8, rval=0xbead4848) at /home/cervantes/hg/mozilla-central/js/src/jsinterp.cpp:439
#47 0x4149473a in JS_CallFunctionValue (cx=0x4267ef20, objArg=0x43f3c040, fval=..., argc=1, argv=0xbead46f8, rval=0xbead4848) at /home/cervantes/hg/mozilla-central/js/src/jsapi.cpp:5829
#48 0x40d1ade8 in nsXPCWrappedJSClass::CallMethod (this=0x444805b0, wrapper=<value optimized out>, methodIndex=<value optimized out>, info_=0x431b8088, nativeParams=0xbead4930) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedJSClass.cpp:1432
#49 0x40d14f9a in nsXPCWrappedJS::CallMethod (this=0x426043c0, methodIndex=3, info=0x431b8088, params=<value optimized out>) at /home/cervantes/hg/mozilla-central/js/xpconnect/src/XPCWrappedJS.cpp:580
#50 0x4122638a in PrepareAndDispatch (self=<value optimized out>, methodIndex=<value optimized out>, args=0xbead49ec) at /home/cervantes/hg/mozilla-central/xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:105
#51 0x412259c0 in SharedStub () from /home/cervantes/git/b2g-device2/B2G/objdir-gecko-dbg/dist/bin/libxul.so
#52 0x40849822 in nsEventListenerManager::HandleEventSubType (this=<value optimized out>, aListenerStruct=<value optimized out>, aListener=0x444cf500, aDOMEvent=0x44b963ac, aCurrentTarget=0x440d1d98, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventListenerManager.cpp:922
#53 0x408499ca in nsEventListenerManager::HandleEventInternal (this=0x444d6150, aPresContext=<value optimized out>, aEvent=0x44b95a00, aDOMEvent=0xbead4b54, aCurrentTarget=0x440d1d98, aEventStatus=0xbead4b58, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventListenerManager.cpp:989
#54 0x40860a8a in nsEventListenerManager::HandleEvent (this=<value optimized out>, aVisitor=..., aMayHaveNewListenerManagers=<value optimized out>, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventListenerManager.h:279
#55 nsEventTargetChainItem::HandleEvent (this=<value optimized out>, aVisitor=..., aMayHaveNewListenerManagers=<value optimized out>, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:183
#56 0x40860c14 in nsEventTargetChainItem::HandleEventTargetChain (this=<value optimized out>, aVisitor=..., aCallback=0x0, aMayHaveNewListenerManagers=<value optimized out>, aPusher=0xbead4b64) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:313
#57 0x40861724 in nsEventDispatcher::Dispatch (aTarget=<value optimized out>, aPresContext=0x444f2400, aEvent=0x44b95a00, aDOMEvent=<value optimized out>, aEventStatus=0xbead4bf0, aCallback=0x0, aTargets=0x0) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:681
#58 0x40861914 in nsEventDispatcher::DispatchDOMEvent (aTarget=0x440d1190, aEvent=0x44b95a00, aDOMEvent=0x44b963ac, aPresContext=0x444f2400, aEventStatus=0xbead4bf0) at /home/cervantes/hg/mozilla-central/content/events/src/nsEventDispatcher.cpp:742
#59 0x409a94a6 in nsGlobalWindow::DispatchEvent (this=0x440d1d30, aEvent=0x44b963ac, aRetVal=0xbead4c57) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:7557
#60 0x409a851a in nsGlobalWindow::FireHashchange (this=0x440d1d30, aOldURL=..., aNewURL=<value optimized out>) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:8147
#61 0x409a85ce in HashchangeCallback::Run (this=0x44e234f0) at /home/cervantes/hg/mozilla-central/dom/base/nsGlobalWindow.cpp:8073
#62 0x4120bc32 in nsThread::ProcessNextEvent (this=0x42607240, mayWait=<value optimized out>, result=0xbead4cff) at /home/cervantes/hg/mozilla-central/xpcom/threads/nsThread.cpp:627
#63 0x411d39d0 in NS_ProcessNextEvent_P (thread=0x0, mayWait=false) at /home/cervantes/git/b2g-device2/B2G/objdir-gecko-dbg/xpcom/build/nsThreadUtils.cpp:238
#64 0x40fbfc12 in mozilla::ipc::MessagePump::Run (this=0x426022e0, aDelegate=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/glue/MessagePump.cpp:82
#65 0x40fbfd9a in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x426022e0, aDelegate=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/glue/MessagePump.cpp:231
#66 0x41241c8e in MessageLoop::RunInternal (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:215
#67 0x41241cee in MessageLoop::RunHandler (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:208
#68 MessageLoop::Run (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:182
#69 0x40efe232 in nsBaseAppShell::Run (this=0x432f4e80) at /home/cervantes/hg/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:163
#70 0x403ef82e in XRE_RunAppShell () at /home/cervantes/hg/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:656
#71 0x40fbfd04 in mozilla::ipc::MessagePumpForChildProcess::Run (this=0x426022e0, aDelegate=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/glue/MessagePump.cpp:198
#72 0x41241c8e in MessageLoop::RunInternal (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:215
#73 0x41241cee in MessageLoop::RunHandler (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:208
#74 MessageLoop::Run (this=0xbead57f4) at /home/cervantes/hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:182
#75 0x403f0142 in XRE_InitChildProcess (aArgc=2, aArgv=0xbead5904, aProcess=1113769984) at /home/cervantes/hg/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:494
#76 0x00008540 in main (argc=7, argv=0xbead5974) at /home/cervantes/hg/mozilla-central/ipc/app/MozillaRuntimeMain.cpp:48
nsGfxScrollFrameInner::ReloadChildFrames() is probably too optimistic in assuming it gets a scrollcornerbox. At least adding  if (content->Tag() == nsGkAtoms::scrollcorner) in the final else block works around the crash.
blocking-b2g: --- → tef?
tracking-b2g18: --- → ?
Severity: normal → critical
Crash Signature: [@ nsFrame::BoxReflow(nsBoxLayoutState&, nsPresContext*, nsHTMLReflowMetrics&, nsRenderingContext*, int, int, int, int, bool)]
Keywords: crash
Whiteboard: [b2g-crash]
Firefox is also affected. Indeed, there has been a spike in crashes since 21.0a1/20130113. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1761f4a9081c&tochange=23eb44a5636b

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsFrame%3A%3ABoxReflow%28nsBoxLayoutState%26%2C+nsPresContext*%2C+nsHTMLReflowMetrics%26%2C+nsRenderingContext*%2C+int%2C+int%2C+int%2C+int%2C+bool%29
status-b2g18: --- → unaffected
status-firefox18: --- → unaffected
status-firefox19: --- → unaffected
status-firefox20: --- → unaffected
status-firefox21: --- → affected
Component: General → Layout
OS: Linux → All
Product: Boot2Gecko → Core
Hardware: x86_64 → All
Keywords: regression
Version: unspecified → 21 Branch
Assignee: nobody → dbaron
blocking-b2g: tef? → tef+
From my testing with the settings app, when the crash happens, content's nodeinfo have localname = "header" and doesn't have "orient" attribute. It looks like

    <section role="region" id="...">
      <header>
      </header>
    </section>

in settings app where the header element passes the test and is incorrectly treated as scrollcorner.
Comment on attachment 702231 [details] [diff] [review]
Add check for scrollcorner in nsGfxScrollFrameInner::ReloadChildFrames().

Review of attachment 702231 [details] [diff] [review]:
-----------------------------------------------------------------

This is OK but I'd like to track down the root cause of the problem.
Attachment #702231 - Flags: feedback?(roc) → review?
(In reply to Cervantes Yu from comment #4)
> From my testing with the settings app, when the crash happens, content's
> nodeinfo have localname = "header" and doesn't have "orient" attribute. It
> looks like
> 
>     <section role="region" id="...">
>       <header>
>       </header>
>     </section>
> 
> in settings app where the header element passes the test and is incorrectly
> treated as scrollcorner.

The thing is, ReloadChildFrames is looking at mOuter's child frames. The <header> element should create an nsBlockFrame that's a child of the anonymous block child of mOuter, i.e. it's not a child of mOuter, but it's a grandchild instead.

Having the <header> element's frame be a direct child of the nsHTMLScrollFrame is a pretty bad bug by itself. Any idea how that happens?

Could it be the patch for bug 827577 that caused this? Is something position:fixed here?
Assignee: dbaron → cyu
So, poking around in the settings app to understand what it's doing:

gaia/apps/settings/index.html has the contents of each section in a comment, which is then parsed and inserted by gaia/apps/settings/js/settings.js 's loadPanel function.

gaia/apps/settings/style/settings.css has:

section[role="region"] {
  position: absolute;
...
  overflow: hidden;
}
...
section[role="region"] {
  transform: translateX(+100%);
  ...
}



I still don't understand the patch to bug 827577, though I'm working on it (put it aside to look at the settings app to see what it's doing).

(In reply to Robert O'Callahan (:roc) (Mozilla Corporation) from comment #7)
> Having the <header> element's frame be a direct child of the
> nsHTMLScrollFrame is a pretty bad bug by itself. Any idea how that happens?

Agreed.  This is really bad.  (But the existing patch here is still good.)
oh, and settings.css also has:

section[role="region"] > header:first-child {
  position: fixed;
  width: 100%;
}
I don't understand the positioning of the inner element prior to the crash, though.

But the above elements of the settings app are sufficient to reproduce the crash, using this simple testcase: bp-956d2380-e4f5-4207-a4be-6203b2130115

And from Linux nightlies the regression range is indeed:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1761f4a9081c&tochange=23eb44a5636b
which seem to confirm roc's suspicion.
Ah, so.

Most things with a content insertion frame seem to forward append/insert to the content insertion frame.  Scrollframe, however, does not.

We special-case scrollframes in nsCSSFrameConstructor::GetAbsoluteContainingBlock to handle this.

The simplest solution is probably to return frame->GetContentInsertionFrame() in the early return in GetFixedContainingBlock, I suspect.
Should we land this first and try comment #11 to track down the root cause in another bug? If yes I will continue the investigation.
Blocks: 831324
I think we should land comment 11 ASAP, whether in this bug or another, since we want to land bug 827577 on branches and hence want this fixed in a way that makes sure there are no problems remaining....
tracking-b2g18: ? → ---
Whiteboard: [b2g-crash] → [b2g-crash][triage:1/16]
> The simplest solution is probably to return
> frame->GetContentInsertionFrame() in the early return in
> GetFixedContainingBlock, I suspect.

This fixes the crash, but with a side effect that the top navigation bar disappears.
+cc: dholbert for a look
Whiteboard: [b2g-crash][triage:1/16] → [b2g-crash][triage:1/16][shadow:dholbert]
I can reproduce this on mozilla-central 01/19 (unagi) 100% of the time.
TEF? tracking-firefox21?
since this is not affecting v1 and only impacting m-c, does not seem to be blocking v1 delivery
blocking-b2g: tef+ → tef?
tracking-firefox21: --- → ?
I landed the null check:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3830ad0eb049

We still need to fix the frames getting misplaced.
Whiteboard: [b2g-crash][triage:1/16][shadow:dholbert] → [b2g-crash][triage:1/16][shadow:dholbert][leave open]
(In reply to Boris Zbarsky (:bz) from comment #11)
> We special-case scrollframes in
> nsCSSFrameConstructor::GetAbsoluteContainingBlock to handle this.
> 
> The simplest solution is probably to return
> frame->GetContentInsertionFrame() in the early return in
> GetFixedContainingBlock, I suspect.

That seems like it would produce incorrect results for tables, which appear to have the opposite content insertion frame for absolutely positioned content that they do for in-flow content.

It seems to me like the bulk of the special logic in GetAbsoluteContainingBlock (everything inside the loop below the IsPositioned check) and possibly also the MathML check above it needs to also be in GetFixedContainingBlock.
(In reply to Robert O'Callahan (:roc) (Mozilla Corporation) from comment #7)
> 
> Having the <header> element's frame be a direct child of the
> nsHTMLScrollFrame is a pretty bad bug by itself. Any idea how that happens?
> 
This happens as follows:
#3  0x406631ca in nsBlockFrame::Init (this=0x44fffa00, aContent=0x1, aParent=0x44b02b78, aPrevInFlow=0x0) at /home/cervantes/hg/mozilla-central/layout/generic/nsBlockFrame.cpp:6452
#4  0x405e2e68 in nsCSSFrameConstructor::InitAndRestoreFrame (this=0x445b6000, aState=..., aContent=0x43ffc150, aParentFrame=0x44b02b78, aPrevInFlow=0x0, aNewFrame=0x44fffa00, aAllowCounters=true) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:4541
#5  0x405ea056 in nsCSSFrameConstructor::ConstructBlock (this=0x445b6000, aState=..., aDisplay=<value optimized out>, aContent=<value optimized out>, aParentFrame=0x44b02b78, aContentParentFrame=0x44b02dd0, aStyleContext=0x44de99c8, aNewFrame=0xbeb24f38, aFrameItems=..., aAbsPosContainer=true, aPendingBinding=0x0) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:11057
#6  0x405ea1f6 in nsCSSFrameConstructor::ConstructNonScrollableBlock (this=0x445b6000, aState=<value optimized out>, aItem=..., aParentFrame=0x44b02dd0, aDisplay=0x44d8d168, aFrameItems=..., aNewFrame=0xbeb24f38) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:4519
#7  0x405e8a26 in nsCSSFrameConstructor::ConstructFrameFromItemInternal (this=0x445b6000, aItem=..., aState=..., aParentFrame=<value optimized out>, aFrameItems=...) at /home/cervantes/hg/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:3612

where 0x44fffa00 corresponds to the <header> element and 0x44b02b78 is an HTMLScrollFrame.
nsCSSFrameConstructor.cpp:11057 is
InitAndRestoreFrame(aState, aContent, parent, nullptr, blockFrame);

I am still debugging why comment #11 makes the header disappear.
Could you share the patch you used in comment 15?
Patch in bug 830192 should fix this bug.
Depends on: 830192
No longer depends on: 830138
blocking-b2g: tef? → -
Let's close this issue. Please reopen it if I'm wrong. Thanks!
Status: NEW → RESOLVED
Closed: 11 years ago
status-b2g18: unaffected → wontfix
status-firefox18: unaffected → wontfix
status-firefox19: unaffected → wontfix
status-firefox20: unaffected → wontfix
status-firefox21: affected → fixed
Resolution: --- → FIXED
(In reply to David Baron [:dbaron] from comment #28)
> We should make sure attachment 702288 [details] lands as a reftest.

I'll do this.
Whiteboard: [b2g-crash][triage:1/16][shadow:dholbert][leave open] → [b2g-crash][triage:1/16][shadow:dholbert]
I landed the reftest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9666a8ee5600
except the underlying problem here still isn't fixed; the content still isn't showing up, even with roc's patch that landed.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Summary: Crash in settings app → Crash in settings app (or, with crash worked around, missing header)
Whiteboard: [b2g-crash][triage:1/16][shadow:dholbert] → [b2g-crash][triage:1/16][shadow:dholbert][leave open]
(In reply to David Baron [:dbaron] from comment #30)
> I landed the reftest:
> https://hg.mozilla.org/integration/mozilla-inbound/rev/9666a8ee5600
> except the underlying problem here still isn't fixed; the content still
> isn't showing up, even with roc's patch that landed.

That patch had a bug (that caused reftest failure). When I reland, it should be OK.
I'll warn you that it might fix the assert without fixing the == test, since there seems to be a pre-existing layout bug floating around as well (and hitting the static case) -- though it might fix that too.
Should this be fixed now? I still see the crash on inbound.
(In reply to Gregor Wagner [:gwagner] from comment #34)
> Should this be fixed now? I still see the crash on inbound.

That should be filed as a separate crash.

This is now fully fixed by bug 830192.
Status: REOPENED → RESOLVED
Closed: 11 years ago → 11 years ago
Resolution: --- → FIXED
Should this be uplifted along with bug 827577 and bug 830192?
Whiteboard: [b2g-crash][triage:1/16][shadow:dholbert][leave open] → [b2g-crash][triage:1/16][shadow:dholbert]
Landed just the reftest per dbaron on IRC.

https://hg.mozilla.org/releases/mozilla-aurora/rev/6051dccd3d5e
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: