288523 - Crash at http://www.fce2.de/main.htm when click on 'forum' [@ nsObjectFrame::Paint ]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050331
Firefox/1.0+

1. Go to http://www.fce2.de/main.htm
2. Left click or Right click on 'forum'
3. CRASH!

creation timestamped on firefox.exe : 31 March 2005, 13:20:08

Doesn't happen with 20050330 build

Talkback TB4746235K

Comment 1

[Steve England [:stevee]]

Peter(6) says if he "block[s] the embedded swf
(http://www.fce2.de/tlc_flash3.swf) [it] WFM"

Crash seems to occur at nsObjectFrame::Paint - talkback implies that bug 56128
might be the culprit

Comment 2

[Steve England [:stevee]]

Official Nightly Gecko/20050330 Firefox/1.0+ works fine
Official Nightly Gecko/20050331 Firefox/1.0+ exhibits the crashing

Comment 3

[Martijn Wargers (dead)]

From the talkback ID:

nsObjectFrame::Paint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 1945]
nsPluginInstanceOwner::GetWindow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 2381]
PresShell::IsVisible 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6403]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5999]
nsViewManager::InvalidateHorizontalBandDifference 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2799]
nsViewManager::BuildDisplayList 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2397]
nsIView::CreateWidget 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
671]
nsWindow::SetNSWindowPtr 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1285]
nsWindow::SetIcon 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 6091]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 4719]
nsWindow::StandardWindowCreate 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1592]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4750 (0x77e14750)
USER32.dll + 0x55b0 (0x77e155b0)
ntdll.dll + 0x1ff57 (0x77f9ff57)
USER32.dll + 0xa877 (0x77e1a877)
nsToolkit::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsToolkit.cpp,
line 61]
nsAlertsService::ShowAlertNotification 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/alerts/src/nsAlertsService.cpp,
line 97]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7c59893d)

Bonsai link:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-03-30+05%3A00%3A00&maxdate=2005-03-31+09%3A00%3A00&cvsroot=%2Fcvsroot

Maybe this happens because of the fix for bug 288222?

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Maybe, but that stack is corrupt because nsPluginInstanceOwner::GetWindow sure
doesn't call Paint() :-)

http://lxr.mozilla.org/mozilla/source/layout/generic/nsObjectFrame.cpp#2377

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Works for me in a GTK2 build. Windows only?

Comment 6

[Carsten Book [:Tomcat]]

Tested with the Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2)
Gecko/2005033106 Suite Trunk and both XP SP2 and W2k SP4 crashed

Talkback Servers seems to have a problem (HTTP Status 500) so i could not
provide any TB-ID.

Comment 7

[Martijn Wargers (dead)]

Attachment: bactrace from freshly Moz debug build

This backtrace looks like it could be a regression from the fix for bug 245349.

Comment 8

[Martijn Wargers (dead)]

Cc-ing you Aaron, this might be a regression from bug 245349.

Comment 9

[Aaron Leventhal]

Most likely timeless' fix for bug 288587 fixes this.

Comment 10

[Peter van der Woude [:Peter6]]

Talkback -> TB4764129Q ,TB4764039W
leftclick or rightclick any Adobe SVG (plugin required) "image" crashes FF.

It looks like ~ the same problem [@  nsObjectFrame::Paint 36d137d3]

Comment 11

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050401
Firefox/1.0+ 09:44 PST

WFM after checkin bug 288587

Comment 12

[Steve England [:stevee]]

Also now WFM after bug 288587 landed

Comment 13

[Peter van der Woude [:Peter6]]

(In reply to comment #11)
> Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050401
> Firefox/1.0+ 09:44 PST
> 
> WFM after checkin bug 288587

Lemme rephrase:
This bug is WFM
comment #10 is now also WFM

Comment 14

[Steve England [:stevee]]

-> Resolved Fixed