Closed Bug 83669 Opened 23 years ago Closed 23 years ago

Crash Opening Tasks | Tools | History - Trunk [@ nsSprocketLayout::Layou]

Categories

(SeaMonkey :: General, defect)

PowerPC
Mac System 9.x
defect
Not set
blocker

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: tracy, Assigned: eric)

References

Details

(4 keywords)

Crash Data

Attachments

(2 files)

seen on Mac commercial build 2001-06-01-04-trunk -Open Tasks | Tools | History Crash everytime this should open the history window I also tried adding history to the sidebar as a workaround. Not!! Opening that tab causes a crash also.
Keywords: smoketest
WFM Linux 2001060108
this bug is Mac only....it works on Windows and Linux
Do we have talkback on Mac? if so could we get an incident ID? thanks! adding alec and hyatt.
Incident ID 31188033 Stack Signature nsSprocketLayout::Layout() a6625a33 Trigger Time 2001-06-01 08:09:53 Email Address twalker@netscape.com Client IP Address 208.12.37.43 User Comments crash in Tasks |Tools | History Build ID 2001060105 Product ID MozillaTrunk Platform ID MacOS Stack Trace nsSprocketLayout::Layout() [nsSprocketLayout.cpp, line 290] nsContainerBox::DoLayout() [nsContainerBox.cpp, line 551] nsBoxFrame::DoLayout() [nsBoxFrame.cpp, line 977] nsBox::Layout() [nsBox.cpp, line 983] nsTreeLayout::LayoutInternal() [nsTreeLayout.cpp, line 264] nsTreeLayout::Layout() [nsTreeLayout.cpp, line 413] nsContainerBox::DoLayout() [nsContainerBox.cpp, line 551] nsBoxFrame::DoLayout() [nsBoxFrame.cpp, line 977] nsBox::Layout() [nsBox.cpp, line 983] nsTreeLayout::LayoutInternal() [nsTreeLayout.cpp, line 264] nsTreeLayout::Layout() [nsTreeLayout.cpp, line 409] nsContainerBox::DoLayout() [nsContainerBox.cpp, line 551] nsBoxFrame::DoLayout() [nsBoxFrame.cpp, line 977] nsXULTreeOuterGroupFrame::DoLayout() [nsXULTreeOuterGroupFrame.cpp, line 416] nsBox::Layout() [nsBox.cpp, line 983] nsScrollBoxFrame::DoLayout() [nsScrollBoxFrame.cpp, line 377]
Adding pp and crash keywords.
Keywords: crash, pp
this is so hyatt :)
Assignee: asa → hyatt
adding eric vaughan as I see Box code here on the stack, not recent style changes.
There's an 0.9.1 bug assigned to evaughan, which he's paying precious little attention to: a crasher in nsScrollBoxFrame. This is likely a dup.
Aforementioned bug is bug 82194.
I can't reproduce this in the modern skin.
I can repro on the classic skin. nsSprocketLayout.cpp, line 275; childBoxSize is a bad, non-null pointer.
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → DUPLICATE
dup of 82194, per hyatt. this is an issue with the scollbar thumb being loaded async from xbl. *** This bug has been marked as a duplicate of 82194 ***
reopening since comments in bug that duped this now says it is not the same bug. still seeing on mac commercial build 2001-06-06-04-trunk branch is okay.
Status: RESOLVED → REOPENED
Resolution: DUPLICATE → ---
The box child size data is trashed. --> evaughan Since it doesn't look like it's tree.
Assignee: hyatt → evaughan
Status: REOPENED → NEW
This is Eric's bug. What seems to be happening in nsSprocketLayout::Layout() is that we can go into a state at while (child || (childBoxSize && childBoxSize->bogus)) where childBoxSize is null. There are a number of unprotected dereferences of childBoxSize in that loop, of which one is childBoxSize = childBoxSize->next; which assigns garbage into childBoxSize. This bug should be on 0.9.2, right?
I think since 82194 was marked as 0.9.1, this bug should be 0.9.1 as well.
I assumed 0.9.2 since twalker says "branch is okay."
*** Bug 84348 has been marked as a duplicate of this bug. ***
r=pink. looks good.
I checked in the fix. There is a commented out assertion there if you want to debug why this happens.
Status: NEW → RESOLVED
Closed: 23 years ago23 years ago
Resolution: --- → FIXED
Adding topcrash keyword and [@ nsSprocketLayout::Layou] to summary for tracking.
Keywords: topcrash
Summary: Crash Opening Tasks | Tools | History → Crash Opening Tasks | Tools | History - Trunk [@ nsSprocketLayout::Layou]
verified
Status: RESOLVED → VERIFIED
Product: Browser → Seamonkey
Crash Signature: [@ nsSprocketLayout::Layou]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: