From Bugzilla Helper: User-Agent: Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.1+) Gecko/ BuildID: 2001061314 Reproducible: Always Steps to Reproduce: 1.Open Preferences 2.Click each twist down for the panels once, starting from the bottom (Debug) towards the top (Appearance) 3.CRASH when you click on the Appearance twist down Actual Results: CRASH Expected Results: Not a crash... Also scroll bars should appear when list grows beyond size that will fit in its area. I noticed this because the scroll bars don't appear always -- this crash seems to happen if the scroll bars are not appearing...

yow! i can repro this on Mac 9.0x, 2001.06.19.08 comm bits. confirming. stack coming soon...

this also occurs on linux and winnt. who should get this? [not sure if it's worth using nsbeta1 at this point --strangely, i still others using it.]

winnt stack trace, talkback #31923803: 0x03cf9ee6 nsCSSFrameConstructor::StyleChangeReflow [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9515] nsCSSFrameConstructor::ProcessRestyledFrames [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9641] nsCSSFrameConstructor::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 10036] StyleSetImpl::AttributeChanged [d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1154] PresShell::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4823] nsXULDocument::AttributeChanged [d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 1624] nsXULElement::UnsetAttribute [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3312] nsXULElement::RemoveAttribute [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1436] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 139] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1883] XPC_WN_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 1253] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2703] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897] JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3322] nsJSContext::CallEventHandler [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 938] nsJSEventListener::HandleEvent [d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140] nsXBLPrototypeHandler::ExecuteHandler [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 430] DoMouse [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLDragHandler.cpp, line 99] nsXBLMouseHandler::MouseClick [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line 118] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1217] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3631] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3650] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5519] PresShell::HandleEventWithTarget [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5491] nsEventStateManager::CheckForAndDispatchClick [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2450] nsEventStateManager::PostHandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1536] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5540] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5446] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2051] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 719] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 736] nsWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4225] ChildWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4470] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3224] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 984] USER32.dll + 0x1820 (0x77e71820)

no talkback avail with my linux verif build, but i'll see if my debug from 6/14 exhibits this. here's a Macsbug trace: Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 04F5A950 06B7EF80 PPC 04F46120 main+00130 06B7EF20 PPC 04F45540 main1(int, char**, nsISupports*)+009A0 06B7EC40 PPC 04D66F80 nsAppShellService::Run()+00018 06B7EC00 PPC 04D27894 nsAppShell::Run()+00048 06B7EBB0 PPC 04D282E4 nsMacMessagePump::DoMessagePump()+0003C 06B7EB60 PPC 04D288D0 nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 0005C 06B7EB10 PPC 04D28C20 nsMacMessagePump::DoMouseDown(EventRecord&)+00100 06B7EA10 PPC 04D29680 nsMacMessagePump::DoMenu(EventRecord&, long)+00084 06B7E8C0 PPC 04D2997C nsMacMessagePump::DispatchMenuCommandToRaptor(EventRecord&, long )+00054 06B7E870 PPC 04D24F6C nsMacMessageSink::DispatchMenuCommand(EventRecord&, long, GrafPo rt*)+00040 06B7E820 PPC 04D1FD8C nsMacWindow::HandleMenuCommand(EventRecord&, long)+ 00020 06B7E7E0 PPC 04D20EF8 nsMacEventHandler::HandleMenuCommand(EventRecord&, long)+000D0 06B7E730 PPC 04D126D8 nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018 06B7E6F0 PPC 04D125E8 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus& )+00078 06B7E6A0 PPC 04D41250 nsMenuBar::MenuSelected(const nsMenuEvent&)+000BC 06B7E5B0 PPC 04D46768 nsMenu::MenuItemSelected(const nsMenuEvent&)+00838 06B7DFE0 PPC 04D4AFEC nsMenuItem::MenuItemSelected(const nsMenuEvent&)+ 00088 06B7DFA0 PPC 04D4B488 nsMenuItem::DoCommand()+00268 06B7DD90 PPC 049D9EDC nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEv ent**, unsigned int, nsEventStatus*)+00D88 06B7D7F0 PPC 047C249C nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, n sIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*)+02214 06B7D400 PPC 047C0000 nsEventListenerManager::HandleEventSubType(nsListenerStruct*, ns IDOMEvent*, nsIDOMEventTarget*, unsigned int, unsigned int)+00258 06B7D280 PPC 044F00A8 nsJSEventListener::HandleEvent(nsIDOMEvent*)+00478 06B7D110 PPC 044D675C nsJSContext::CallEventHandler(void*, void*, unsigned int, void*, int*, int)+001BC 06B7D050 PPC 04DF75A4 JS_CallFunctionValue+00028 06B7D010 PPC 04E14404 js_InternalInvoke+000BC 06B7CF50 PPC 04E141C8 js_Invoke+00694 06B7CE40 PPC 04E1C110 js_Interpret+07218 06B7CB80 PPC 04E14170 js_Invoke+0063C 06B7CA70 PPC 04DB7520 XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, lo ng*)+00138 06B7C9A0 PPC 04DB1AAC XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative:: CallMode)+00AFC 06B7C650 PPC 04EB6BF4 XPTC_InvokeByIndex+0000C 06B7C610 PPC 04EB6CFC _XPTC_InvokeByIndex+000C8 06B7C568 PPC 044E4A48 GlobalWindowImpl::OpenDialog(nsIDOMWindow**)+0020C 06B7C318 PPC 044E8790 GlobalWindowImpl::OpenInternal(const nsAString&, const nsAString &, const nsAString&, int, long*, unsigned int, nsISupports*, nsIDOMWindow**)+ 0048C 06B7BF78 PPC 07537BD0 nsWindowWatcher::OpenWindowJS(nsIDOMWindow*, const char*, const char*, const char*, int, unsigned int, long*, nsIDOMWindow**)+010D0 06B7BA38 PPC 04D72374 nsContentTreeOwner::ShowAsModal()+00018 06B7B9F8 PPC 04D61984 nsWebShellWindow::ShowModal()+0000C 06B7B9B8 PPC 04D74A84 nsXULWindow::ShowModal()+0022C 06B7B918 PPC 04D27FD0 nsAppShell::DispatchNativeEvent(int, void*)+00024 06B7B8D8 PPC 04D288E4 nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 00070 06B7B888 PPC 04D29328 nsMacMessagePump::DoMouseUp(EventRecord&)+0004C 06B7B838 PPC 04D298AC nsMacMessagePump::DispatchOSEventToRaptor(EventRecord&, GrafPort *)+00040 06B7B7E8 PPC 04D24EB8 nsMacMessageSink::DispatchOSEvent(EventRecord&, GrafPort*)+00038 06B7B7A8 PPC 04D1FD0C nsMacWindow::HandleOSEvent(EventRecord&)+00020 06B7B768 PPC 04D20CE4 nsMacEventHandler::HandleOSEvent(EventRecord&)+000CC 06B7B718 PPC 04D22748 nsMacEventHandler::HandleMouseUpEvent(EventRecord&)+ 00048 06B7B688 PPC 04D1281C nsWindow::DispatchMouseEvent(nsMouseEvent&)+00054 06B7B628 PPC 04D126D8 nsWindow::DispatchWindowEvent(nsGUIEvent&)+00018 06B7B5E8 PPC 04D12604 nsWindow::DispatchEvent(nsGUIEvent*, nsEventStatus& )+00094 06B7B598 PPC 043C2350 HandleEvent(nsGUIEvent*)+00058 06B7B548 PPC 043D3EB0 nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*)+0061C 06B7B418 PPC 043C2F58 nsView::HandleEvent(nsGUIEvent*, unsigned int, nsEventStatus*, i nt, int&)+00248 06B7B378 PPC 0454DA1C PresShell::HandleEvent(nsIView*, nsGUIEvent*, nsEventStatus*, in t, int&)+0027C 06B7B308 PPC 0454DDB0 PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned int, nsEventStatus*)+00218 06B7B2A8 PPC 047C9AD4 nsEventStateManager::PostHandleEvent(nsIPresContext* , nsEvent*, nsIFrame*, nsEventStatus*, nsIView*)+00534 06B7B098 PPC 047CBAD8 nsEventStateManager::CheckForAndDispatchClick(nsIPresContext*, n sMouseEvent*, nsEventStatus*)+0015C 06B7AF68 PPC 0454DB08 PresShell::HandleEventWithTarget(nsEvent*, nsIFrame* , nsIContent *, unsigned int, nsEventStatus*)+00040 06B7AF18 PPC 0454DCA4 PresShell::HandleEventInternal(nsEvent*, nsIView*, unsigned int, nsEventStatus*)+0010C 06B7AEB8 PPC 049D9FD8 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEv ent**, unsigned int, nsEventStatus*)+00E84 06B7A918 PPC 049D9FD8 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEv ent**, unsigned int, nsEventStatus*)+00E84 06B7A378 PPC 049D9FD8 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEv ent**, unsigned int, nsEventStatus*)+00E84 06B79DD8 PPC 049D9FD8 nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEv ent**, unsigned int, nsEventStatus*)+00E84 06B79838 PPC 049D9EDC nsXULElement::HandleDOMEvent(nsIPresContext*, nsEvent*, nsIDOMEv ent**, unsigned int, nsEventStatus*)+00D88 06B79298 PPC 047C06B8 nsEventListenerManager::HandleEvent(nsIPresContext*, nsEvent*, n sIDOMEvent**, nsIDOMEventTarget*, unsigned int, nsEventStatus*)+00430 06B78EA8 PPC 04961FFC nsXBLMouseHandler::MouseClick(nsIDOMEvent*)+000B4 06B78E38 PPC 0495B284 nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver*, nsID OMEvent*)+016A4 06B78598 PPC 044F00A8 nsJSEventListener::HandleEvent(nsIDOMEvent*)+00478 06B78428 PPC 044D675C nsJSContext::CallEventHandler(void*, void*, unsigned int, void*, int*, int)+001BC 06B78368 PPC 04DF75A4 JS_CallFunctionValue+00028 06B78328 PPC 04E14404 js_InternalInvoke+000BC 06B78268 PPC 04E141C8 js_Invoke+00694 06B78158 PPC 04E1C110 js_Interpret+07218 06B77E98 PPC 04E14170 js_Invoke+0063C 06B77D88 PPC 04DB7520 XPC_WN_CallMethod(JSContext*, JSObject*, unsigned int, long*, lo ng*)+00138 06B77CB8 PPC 04DB1AAC XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative:: CallMode)+00AFC 06B77968 PPC 04EB6BF4 XPTC_InvokeByIndex+0000C 06B77928 PPC 04EB6CFC _XPTC_InvokeByIndex+000C8 06B77880 PPC 049D20B8 nsXULElement::RemoveAttribute(const nsAString&)+ 000B0 06B777F0 PPC 049D8990 nsXULElement::UnsetAttribute(int, nsIAtom*, int)+ 00B78 06B771C0 PPC 04995A9C nsXULDocument::AttributeChanged(nsIContent*, int, nsIAtom*, int) +000DC 06B77020 PPC 0454C038 PresShell::AttributeChanged(nsIDocument*, nsIContent*, int, nsIA tom*, int)+0004C 06B76FD0 PPC 04752024 StyleSetImpl::AttributeChanged(nsIPresContext*, nsIContent*, int , nsIAtom*, int)+00018 06B76F90 PPC 046187B8 nsCSSFrameConstructor::AttributeChanged(nsIPresContext*, nsICont ent*, int, nsIAtom*, int)+009C4 06B76C20 PPC 046176D8 nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList&, nsIPresContext*)+000A0 06B76BC0 PPC 046171B4 nsCSSFrameConstructor::StyleChangeReflow(nsIPresContext*, nsIFra me*, nsIAtom*)+00060 06B76B00 PPC 04E82110 nsCOMPtr_base::assign_from_helper(const nsCOMPtr_helper&, const nsID&)+00028 06B76AB0 PPC 04E81FDC nsCOMPtr_base::~nsCOMPtr_base()+00030 Closing log

updating summary to reflect what was done to incur crash.

Crashing in nsCSSFrameConstructor::StyleChangeReflow(), so -> attinasi

this also occurs if i just use the keyboard [arrow keys] to go thru and expand/ collapse the twisties. was able to crash using the linux 6/14 debug...just waiting for gdb to respond...

trace from linux mozilla debug of 6/14: #0 0x156 in ?? () #1 0x415ad52a in nsCOMPtr<nsIBox>::assign_from_helper (this=0xbfffd2cc, helper=@0xbfffd2d0, aIID=@0x41640990) at ../../../dist/include/nsCOMPtr.h:971 #2 0x414b979b in nsCSSFrameConstructor::StyleChangeReflow (this=0x87ce4f8, aPresContext=0x87cdc98, aFrame=0x8821e8c, aAttribute=0x0) at ../../../../dist/include/nsCOMPtr.h:564 #3 0x414ba117 in nsCSSFrameConstructor::ProcessRestyledFrames ( this=0x87ce4f8, aChangeList=@0xbfffd488, aPresContext=0x87cdc98) at nsCSSFrameConstructor.cpp:9626 #4 0x414bc69e in nsCSSFrameConstructor::AttributeChanged (this=0x87ce4f8, aPresContext=0x87cdc98, aContent=0x87f5058, aNameSpaceID=0, aAttribute=0x8195010, aHint=3) at nsCSSFrameConstructor.cpp:10021 #5 0x4115affd in ?? () from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so #6 0x41421e75 in PresShell::AttributeChanged (this=0x87ce590, aDocument=0x87cca70, aContent=0x87f5058, aNameSpaceID=0, aAttribute=0x8195010, aHint=-1) at nsPresShell.cpp:4821 #7 0x4102b00c in ?? () from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so #8 0x4100736f in ?? () from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so #9 0x40ffd5ef in ?? () from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so #10 0x4011a061 in ?? () from /builds/sairuh/mozilla/dist/bin/libxpcom.so #11 0x407816b9 in ?? () from /builds/sairuh/mozilla/dist/bin/components/libxpconnect.so #12 0x40789da2 in ?? () from /builds/sairuh/mozilla/dist/bin/components/libxpconnect.so #13 0x401b0fd6 in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so #14 0x401bb0a2 in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so #15 0x401b1033 in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so #16 0x401b125c in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so #17 0x401927bf in ?? () from /builds/sairuh/mozilla/dist/bin/libmozjs.so #18 0x4168ed93 in ?? () from /builds/sairuh/mozilla/dist/bin/components/libjsdom.so #19 0x416d4796 in ?? () from /builds/sairuh/mozilla/dist/bin/components/libjsdom.so #20 0x410ac530 in ?? () from /builds/sairuh/mozilla/dist/bin/components/libgkcontent.so

It looks like the primary frame for a XULElement is invalid and is causing the crash when it is QI'd. The content element is valid in CSSFrameConstructor::AttributeChanged, but the primaryFrame retrieved from GetPrimaryFrame comes back looking invalid (or corrupted). Hyatt, could you take a look? Assign it back if you think it should be mine...

I believe I just had this happen 3 times. TB32146423H TB32146407Q TB32146034X Build 2001062420 Win2k.

janc, could you tell how often this crash is occurring? thx!

*** Bug 88383 has been marked as a duplicate of this bug. ***

Yup, got a crash, linux 2001062814 Talkback id: TB32338411Q

I can repro this bug with moz0.9.2/linux every time with the testcase given by the original reporter. However, only closing the TOP twisty crashes for me, and even that doesn't every time if the ones below it are opened in some orders. However, going top-to-bottom opening each one, then closing the top one, crashes EVERY time for me.

I can't check the database for crashes right now (db access problems,) but it's not showing up at all on the top40 talkback analysis reports for M092 or trunk today.

Whoever is working on this bug want to take a look at bug 88652 and figure out if that bug is a duplicate of this bug?

*** Bug 88652 has been marked as a duplicate of this bug. ***

This one is showing up in as many as 15 incidents in the M092 build scattered across Mac and Linux. It hides under module level signatures 0x0000007f & 0xc04a5efc in the Talkback data. (That's why janc didn't find any top40 incidents on 7/2.) The stack is similar to sairuh's Linux stack of 6/19. (See above attachment) However, it does qualify as a topcrasher. Adding topcrash keyword.

I see this one in a slightly modified form on Win32, Linux and Mac. Since the Appearance section is already open, I actually see this when I click from top to bottom, then close the Appearance section. Scrollbars will briefly appear, and the *poof*.

Actually, when I first close the Appearance section, then move upward opening all sections, everything's "fine" (still no scrollbars), but at least I don't crash. I'm looking at this in a debugger now.

I worked with this some last week and found the following on win32: If I open all the trees (up to Composer) I do not get a scroll bar. However, if I close the Composer tree... in the DOS box I get frame: box (02BF1558) style: 02BF029C {} Wrong parent style context: style: 02BCFE20{} should be using: style: 02C118F0 {} this is found in nsFrameManager.cpp line 1225 This happens after aParentContext != actualParentContext (line 1219). All continues to work ok... and I get a scroll bar. I can even continue up to the Appearance twist down and work correctly (allbeit continue to get this "Wrong parent style" message). Yet... if I close out the preference dialog and reopening (following the steps above).... I get the same basic message. Not sure if this helps However....

There is a rendering problem in the preferences tree, that I guess leads to the crash in this bug. To see it (I use win98): click on "Privacy and security" to open it, and then click on "Mail and newsgroups" to open it. If you will look closely you'll see that the "Mail and newsgroups" subtree that opens hides or "overrides" the "Privacy and Security" tree, instead of the "Privacy and Security" tree moving lower when the "Mail and newsgroups" tree opens. Now, If you click on "Appearance" mozilla crashes. Notice that if you do it in the reverse order: first open "Mail and newsgroups" and then "Privacy and security", it doesn't happen.

*** Bug 91766 has been marked as a duplicate of this bug. ***

*** Bug 93373 has been marked as a duplicate of this bug. ***

From bug 93373 here are some more talkback traces (from 0.9.3) and his reproducable steps: Mozilla 0.9.3 talkback build -- Talkback Incident IDs TB33678580K, TB33679497Z, TB33679580H Here is how I have fairly consistently reproduced this bug in Mozilla 0.9.3 1. I bring up Preferences dialog. 2. Starting from the top of the "Category" pane, I select and view each and every category in turn, expanding each group of categories as needed. 3. Eventually all following categories will have expanded to off the bottom of the "Category" pane -- however, the "Category" pane (fairly consistently) does not show a scrollbar so that I can scroll down to see them. [Note: it is important to view each category in turn, not just to expand each group of categories.] 4. I collapse the topmost group of categories, named "Appearance". 5. At this point, Mozilla 0.9.3 crashes (fairly consistently). NB: If the scrollbar appears correctly in #3 above, then the crash seems to be less likely to occur.

*** Bug 93597 has been marked as a duplicate of this bug. ***

When the scrollbar appears, it is too small and you cant reach the menuitems at the bottom

*** Bug 97022 has been marked as a duplicate of this bug. ***

Roy Voortman experienced this Bug on build 2001082608 with TB34710445X (full report can be found here : Bug 59180 - posted 2001-08-30 00:31)

Markus made a typo in the bug nr. The full report can be found in Bug 59108.

I was just able to repro with today's MozillaTrunk build 2001090408 on WinNT. Here's my incident: Incident ID 34953337 Stack Signature 0x00000012 aa427aab Bug ID Trigger Time 2001-09-04 19:25:48 Email Address jpatel@netscape.com User Comments in prefs, expanded as many sections as possible and then collapsed the top one...reproducing bug 86723 Build ID 2001090410 Product ID MozillaTrunk Platform ID Win32 Trigger Reason Access violation Stack Trace 0x00000012 nsCSSFrameConstructor::StyleChangeReflow [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9735] nsCSSFrameConstructor::ProcessRestyledFrames [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9871] nsCSSFrameConstructor::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 10245] StyleSetImpl::AttributeChanged [d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1230] PresShell::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4962] nsXULDocument::AttributeChanged [d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 1742] nsXULElement::UnsetAttr [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3349] nsXULElement::RemoveAttribute [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1458] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 139] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1954] XPC_WN_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 1263] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2720] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 900] JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3362] nsJSContext::CallEventHandler [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 956] nsJSEventListener::HandleEvent [d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140] nsXBLPrototypeHandler::ExecuteHandler [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 433] DoMouse [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseMotionHandler.cpp, line 87] nsXBLMouseHandler::MouseClick [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line 118] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1296] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3711] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5664] PresShell::HandleEventWithTarget [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5634] nsEventStateManager::CheckForAndDispatchClick [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2466] nsEventStateManager::PostHandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1552] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5685] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5589] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2058] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 732] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 749] nsWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4264] ChildWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4514] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3251] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 997] USER32.dll + 0x1820 (0x77e71820) It's look like we have a reproducible test base and plenty of stack traces...so if you need any more info from Talkback, let me know.

*** Bug 98331 has been marked as a duplicate of this bug. ***

take a look at bug 98548. It deals with categories in the new Mozillazine Sidebar which also exhibits this behavior. It might be that any XUL tree is setting this off (not just preferences).

*** Bug 99882 has been marked as a duplicate of this bug. ***

*** Bug 99902 has been marked as a duplicate of this bug. ***

Hyatt says it is a tree widget bug, should be nsbranch-

This is a topcrasher with M094. It's showing up under the stack signatures: 0xffc10000 86e4b15e for Mac 0x00000000 for Linux and various others for Win32. Adding M094 and [@ 0xffc10000 86e4b15e, 0x00000000, 0x00000005, 0x000000017, 0x0000000a - nsCSSFrameConstructor::ProcessRestyledFrames, nsCSSFrameConstructor::StyleChangeReflow] to summary for tracking. Here is the latest incident from M094 Mac topcrash reports: Incident ID 35504171 Stack Signature 0xffc10000 86e4b15e Bug ID Trigger Time 2001-09-17 11:23:29 Email Address User Comments editing preferences. collapsing tabs on the left. Build ID 2001091311 Product ID Netscape6.20 Platform ID MacOS Trigger Reason Illegal PowerPC instruction Stack Trace 0xffc10000 nsCSSFrameConstructor::ProcessRestyledFrames() [nsCSSFrameConstructor.cpp, line 9870] nsCSSFrameConstructor::AttributeChanged() [nsCSSFrameConstructor.cpp, line 10244] StyleSetImpl::AttributeChanged() [nsStyleSet.cpp, line 1227] PresShell::AttributeChanged() [nsPresShell.cpp, line 4956] nsXULDocument::AttributeChanged() [nsXULDocument.cpp, line 1740] nsXULElement::UnsetAttr() [nsXULElement.cpp, line 3345] This is also being reported on Windows and Linux. There are A LOT of these crashes in Talkback, but they are distributed across many different stack signatures like 0x00000000, 0x00000017, 0x0000000a, 0x00000005 and many others. I won't bother pasting in all the information, but you can go to http://warp/u/talkback/reports/M094/comment/pref-comment.html and scan through the incidents there, almost all of them are crashes involving the collapsing of category twisties in the prefs dialog. Here is just a couple of those incidents: Linux: Incident ID 35554795 Stack Signature 0x00000000 51be58b7 Bug ID Trigger Time 2001-09-18 11:27:34 Email Address rice_raymond@hotmail.com User Comments failed while viewing options in edit->preferences. i was closing the categories Build ID 2001091311 Product ID Netscape6.20 Platform ID LinuxIntel Trigger Reason SIGSEGV: Segmentation Fault: (signal 11) Stack Trace 0x00000000 nsCSSFrameConstructor::ProcessRestyledFrames() nsCSSFrameConstructor::AttributeChanged() StyleSetImpl::AttributeChanged() PresShell::AttributeChanged() nsXULDocument::AttributeChanged() nsXULElement::UnsetAttr() nsXULElement::RemoveAttribute() XPTC_InvokeByIndex() XPCWrappedNative::CallMethod() XPC_WN_CallMethod() js_Invoke() js_Interpret() js_Invoke() js_InternalInvoke() JS_CallFunctionValue() nsJSContext::CallEventHandler() nsJSEventListener::HandleEvent() nsXBLPrototypeHandler::ExecuteHandler() nsXBLMouseHandler::MouseClick() nsEventListenerManager::HandleEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() nsXULElement::HandleDOMEvent() PresShell::HandleEventInternal() PresShell::HandleEventWithTarget() nsEventStateManager::CheckForAndDispatchClick() nsEventStateManager::PostHandleEvent() PresShell::HandleEventInternal() PresShell::HandleEvent() nsView::HandleEvent() nsViewManager::DispatchEvent() HandleEvent() nsWidget::DispatchEvent() nsWidget::DispatchWindowEvent() nsWidget::DispatchMouseEvent() nsWidget::OnButtonReleaseSignal() nsWindow::HandleGDKEvent() dispatch_superwin_event() handle_gdk_event() libgdk-1.2.so.0 + 0x17077 (0x40313077) libglib-1.2.so.0 + 0xfe62 (0x40342e62) libglib-1.2.so.0 + 0x104cb (0x403434cb) libglib-1.2.so.0 + 0x10681 (0x40343681) libgtk-1.2.so.0 + 0x8e1e7 (0x402661e7) nsAppShell::Run() nsAppShellService::Run() main1() main() libc.so.6 + 0x18a42 (0x4043ba42) Win32: Incident ID 35556083 Stack Signature 0x00000005 39c91796 Bug ID Trigger Time 2001-09-18 11:57:39 User Comments Just installed Mozilla 0.9.4 and clicking away in preferences. Build ID 2001091311 Product ID Netscape6.20 Platform ID Win32 Trigger Reason Access violation Stack Trace 0x00000005 nsCSSFrameConstructor::StyleChangeReflow [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9735] nsCSSFrameConstructor::ProcessRestyledFrames [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 9871] nsCSSFrameConstructor::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 10245] StyleSetImpl::AttributeChanged [d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1230] PresShell::AttributeChanged [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4958] nsXULDocument::AttributeChanged [d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 1742] nsXULElement::UnsetAttr [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3349] nsXULElement::RemoveAttribute [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 1458] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 139] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1954] XPC_WN_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 1263] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2720] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 900] JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3362] nsJSContext::CallEventHandler [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 956] nsJSEventListener::HandleEvent [d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140] nsXBLPrototypeHandler::ExecuteHandler [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLPrototypeHandler.cpp, line 433] DoMouse [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseMotionHandler.cpp, line 87] nsXBLMouseHandler::MouseClick [d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLMouseHandler.cpp, line 118] nsEventListenerManager::HandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line 1296] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3711] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730] nsXULElement::HandleDOMEvent [d:\builds\seamonkey\mozilla\content\xul\content\src\nsXULElement.cpp, line 3730] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5660] PresShell::HandleEventWithTarget [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5630] nsEventStateManager::CheckForAndDispatchClick [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 2466] nsEventStateManager::PostHandleEvent [d:\builds\seamonkey\mozilla\content\events\src\nsEventStateManager.cpp, line 1552] PresShell::HandleEventInternal [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5681] PresShell::HandleEvent [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5585] nsView::HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 377] nsViewManager::DispatchEvent [d:\builds\seamonkey\mozilla\view\src\nsViewManager.cpp, line 2058] HandleEvent [d:\builds\seamonkey\mozilla\view\src\nsView.cpp, line 68] nsWindow::DispatchEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 732] nsWindow::DispatchWindowEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 749] nsWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4264] ChildWindow::DispatchMouseEvent [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 4514] nsWindow::ProcessMessage [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 3251] nsWindow::WindowProc [d:\builds\seamonkey\mozilla\widget\src\windows\nsWindow.cpp, line 997] USER32.DLL + 0x2e98 (0x77e12e98) USER32.DLL + 0x30e0 (0x77e130e0) USER32.DLL + 0x5824 (0x77e15824) nsAppShellService::Run [d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 453] main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1276] main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1593] WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1611] WinMainCRTStartup() KERNEL32.DLL + 0x17d08 (0x77e97d08) I know this was just given a -, but if we do know what is causing this crash, it would be nice to get the fix into the next release. If all the crashes reported across different stack signatures were put together, this would be in the top 3 of M094 topcrashers.

Clean up the crap.

Simon: All that might look like crap to you, but the Talkback team would like to have it there for tracking purposes...so I'm putting the "crap" back. Sorry if it's messy, but it just makes keeping track of topcrashers easier for us. Thanks.

*** Bug 98548 has been marked as a duplicate of this bug. ***

*** Bug 97323 has been marked as a duplicate of this bug. ***

*** Bug 101278 has been marked as a duplicate of this bug. ***

*** Bug 101705 has been marked as a duplicate of this bug. ***

Sorry, making some changes to the summary again...adding 0x00000009, since this crash is showing up in Talkback under that stack signature also. Collectively, this is probably one of the top 3 crashers for Mozilla 0.9.4...since it's being reported under so many different stack signatures. Is it too late to reconsider this one the nsbranch? The following comment was made before we realized how wide spread this problem was. ------- Additional Comments From Peter Trudelle 2001-09-16 23:19 ------- Hyatt says it is a tree widget bug, should be nsbranch-

*** Bug 104428 has been marked as a duplicate of this bug. ***

->098

I needed to fix this one in our version of 0.9.3 so here is what I did, let me know if it seems OK. In nsCSSFrameConstructor::ProcessRestyledFrames I see two problems 1. ChangeAt() expects 0-base indexes so the while statement should be while( 0 <= --count ) 2. The call to RecreateFramesForContent() should be followed by something that will break out of the loop, like: count = 0; // force exit from loop otherwise the frames in the rest of the list will be invalid.

Updating the summary. Still seeing this one on Mac in M095 and N620.

*** Bug 109689 has been marked as a duplicate of this bug. ***

From attachment 55787 [details] [diff] [review] (Comment #50): - while (0 < count--) { + while (0 <= --count) { These are completely the same, unless I'm going senile. (I strongly prefer (count-- > 0) but that's beside the point).

So they are, oops. The important part of the patch is exiting the loop early after calling RecreateFramesForContent().

*** Bug 111306 has been marked as a duplicate of this bug. ***

*** Bug 111460 has been marked as a duplicate of this bug. ***

*** Bug 113695 has been marked as a duplicate of this bug. ***

*** Bug 114144 has been marked as a duplicate of this bug. ***

*** Bug 114264 has been marked as a duplicate of this bug. ***

hyatt et al., how does this patch look? or, has it bit-rotted? and/or would conversion to outliner take care of this?

You shouldn't break out of the change list when recreating frames. What is presumably happening is that some frame later in the list is trashed and that may even be because of a recreate earlier in the list, but the better question is "How did a descendant frame get into the list of frames to process?"

stealing

fixed

Ummm... ususally it is good practice to write in the bug how it was fixed/resolved. There was no patch checked in as far as I know, and none approved and mentioned in the bug. This bug is then not actually "fixed" without a patch to repair the error. If the problem is no longer seen, the bug then becomes "worksforme"

bug 99715 - convert category tree to use outliner r=hixie sr=blake checked in by varga at ~3pm PST today.

oh sorry, I thought that it had been already mentionted that conversion to outliner will fix this problem.

yay! vrfy fixed, using comm bits [2002.01.07.0x] on linux rh7.2, winnt and mac 10.1.2.

*** Bug 123125 has been marked as a duplicate of this bug. ***

shortening summary per justdave's orders, summaries will have a shorter limit in future