Got this crash on enabling gfx scrollbar and visiting test12 (gdb) bt #0 0x40d8e55a in nsBlockReflowState::nsBlockReflowState (this=0xbfffe878, aReflowState=@0xbfffeb20, aPresContext=0x85d0fe0, aFrame=0x85c0750, aMetrics=@0xbfffebe4) at nsBlockFrame.cpp:488 #1 0x40d8fba4 in nsBlockFrame::Reflow (this=0x85c0750, aPresContext=@0x85d0fe0, aMetrics=@0xbfffebe4, aReflowState=@0xbfffeb20, aStatus=@0xbffff044) at nsBlockFrame.cpp:1245 #2 0x40d8d1cc in nsAreaFrame::Reflow (this=0x85c0750, aPresContext=@0x85d0fe0, aDesiredSize=@0xbfffebe4, aReflowState=@0xbfffeb20, aStatus=@0xbffff044) at nsAreaFrame.cpp:283 #3 0x40d9c310 in nsContainerFrame::ReflowChild (this=0x86823d0, aKidFrame=0x85c0750, aPresContext=@0x85d0fe0, aDesiredSize=@0xbfffebe4, aReflowState=@0xbfffeb20, aStatus=@0xbffff044) at nsContainerFrame.cpp:372 #4 0x40de229e in nsScrollPortFrame::Reflow (this=0x86823d0, aPresContext=@0x85d0fe0, aDesiredSize=@0xbfffee54, aReflowState=@0xbfffecfc, aStatus=@0xbffff044) at nsScrollPortFrame.cpp:444 #5 0x40d9c310 in nsContainerFrame::ReflowChild (this=0x85c1a40, aKidFrame=0x86823d0, aPresContext=@0x85d0fe0, aDesiredSize=@0xbfffee54, aReflowState=@0xbfffecfc, aStatus=@0xbffff044) at nsContainerFrame.cpp:372 #6 0x40de0223 in nsGfxScrollFrameInner::ReflowFrame (this=0x8682390, aPresContext=@0x85d0fe0, aDesiredSize=@0xbfffee54, aReflowState=@0xbfffef40, aStatus=@0xbffff044, aFrame=0x86823d0, aAvailable=@0xbfffee4c, aComputed=@0xbfffee4c, aResized=@0xbfffee48, aIncrementalChild=@0xbfffeed8) at nsGfxScrollFrame.cpp:1167 #7 0x40de03ee in nsGfxScrollFrameInner::ReflowScrollArea (this=0x8682390, aPresContext=@0x85d0fe0, aDesiredSize=@0xbfffefe8, aReflowState=@0xbfffef40, aStatus=@0xbffff044, aHscrollbarNeedsReflow=@0xbfffeee4, aVscrollbarNeedsReflow=@0xbfffeee0, aScrollAreaNeedsReflow=@0xbfffeedc, aIncrementalChild=@0xbfffeed8) at nsGfxScrollFrame.cpp:1232 #8 0x40ddf0cf in nsGfxScrollFrame::Reflow (this=0x85c1a40, aPresContext=@0x85d0fe0, aDesiredSize=@0xbfffefe8, aReflowState=@0xbfffef40, aStatus=@0xbffff044) at nsGfxScrollFrame.cpp:455 #9 0x40dddeff in ViewportFrame::ReflowFixedFrame (this=0x83ac378, aPresContext=@0x85d0fe0, aReflowState=@0xbffff050, aKidFrame=0x85c1a40, aInitialReflow=1, aStatus=@0xbffff044) at nsViewportFrame.cpp:347 #10 0x40dde1e7 in ViewportFrame::IncrementalReflow (this=0x83ac378, aPresContext=@0x85d0fe0, aReflowState=@0xbffff268) at nsViewportFrame.cpp:440 #11 0x40dde366 in ViewportFrame::Reflow (this=0x83ac378, aPresContext=@0x85d0fe0, aDesiredSize=@0xbffff384, aReflowState=@0xbffff268, aStatus=@0xbffff264) at nsViewportFrame.cpp:479 #12 0x40db0e53 in nsHTMLReflowCommand::Dispatch (this=0x83b9920, aPresContext=@0x85d0fe0, aDesiredSize=@0xbffff384, aMaxSize=@0xbffff36c, aRendContext=@0x83b9958) at nsHTMLReflowCommand.cpp:137 #13 0x40dcc156 in PresShell::ProcessReflowCommands (this=0x8595e38) at nsPresShell.cpp:1297 #14 0x40dc9d7b in PresShell::ExitReflowLock (this=0x8595e38) at nsPresShell.cpp:599 #15 0x40dcd7fa in PresShell::ContentAppended (this=0x8595e38, aDocument=0x87801a0, aContainer=0x8626fec, aNewIndexInContainer=0) at nsPresShell.cpp:1735 #16 0x40f8ded7 in nsDocument::ContentAppended (this=0x87801a0, aContainer=0x8626fec, aNewIndexInContainer=0) at nsDocument.cpp:1522 #17 0x40e7d73e in nsHTMLDocument::ContentAppended (this=0x87801a0, aContainer=0x8626fec, aNewIndexInContainer=0) at nsHTMLDocument.cpp:1040 #18 0x40e78c81 in HTMLContentSink::NotifyBody (this=0x87ab0e0) at nsHTMLContentSink.cpp:278 #19 0x40e72dbd in HTMLContentSink::WillInterrupt (this=0x87ab0e0) at nsHTMLContentSink.cpp:1843 #20 0x4113632a in CNavDTD::WillInterruptParse (this=0x8626e10) at CNavDTD.cpp:3029 #21 0x4113f927 in nsParser::ResumeParse (this=0x87ab2e0, aDefaultDTD=0x0, aIsFinalChunk=0) at nsParser.cpp:985 #22 0x411403ba in nsParser::OnDataAvailable (this=0x87ab2e0, channel=0x8689dc0, aContext=0x0, pIStream=0x8634f78, sourceOffset=0, aLength=2565) at nsParser.cpp:1372 #23 0x4092283d in ?? () from /home/dp/build.debug/mozilla/dist/bin/libraptorwebwidget.so #24 0x4092349c in ?? () from /home/dp/build.debug/mozilla/dist/bin/libraptorwebwidget.so #25 0x40b5352d in ?? () from /home/dp/build.debug/mozilla/dist/bin/components/libnecko_file.so #26 0x408bf4b6 in ?? () from /home/dp/build.debug/mozilla/dist/bin/components/libnecko.so #27 0x408bec5a in ?? () from /home/dp/build.debug/mozilla/dist/bin/components/libnecko.so #28 0x401952bb in ?? () from /home/dp/build.debug/mozilla/dist/bin/libplds3.so #29 0x401951cc in ?? () from /home/dp/build.debug/mozilla/dist/bin/libplds3.so #30 0x401556a9 in nsEventQueueImpl::ProcessPendingEvents (this=0x8083fb8) at nsEventQueue.cpp:118 #31 0x4051d6d6 in ?? () from /home/dp/build.debug/mozilla/dist/bin/libwidget_gtk.so #32 0x4067f789 in ?? () from /usr/lib/libgdk-1.2.so.0 #33 0x406abd6a in ?? () from /usr/lib/libglib-1.2.so.0 #34 0x406ad2c6 in ?? () from /usr/lib/libglib-1.2.so.0 #35 0x406ad801 in ?? () from /usr/lib/libglib-1.2.so.0 #36 0x406ad979 in ?? () from /usr/lib/libglib-1.2.so.0 #37 0x405dcf3a in ?? () from /usr/lib/libgtk-1.2.so.0 #38 0x4051dea9 in ?? () from /home/dp/build.debug/mozilla/dist/bin/libwidget_gtk.so #39 0x40393441 in ?? () from /home/dp/build.debug/mozilla/dist/bin/libnsappshell.so #40 0x804b677 in main1 (argc=1, argv=0xbffffa34) at nsAppRunner.cpp:589 #41 0x804b8f9 in main (argc=1, argv=0xbffffa34) at nsAppRunner.cpp:699 #42 0x4028dcb3 in ?? () from /lib/libc.so.6 (gdb)

Since it worked before gfx scrollbars, it has to be something that eric's doing in his container class that violates the rules.

This is that space manager with area frame in nsCSSFrameConstructor we talked about.

Fixed in the Oct 22 Linux build.