542260 - Crash [@ nsIFrame::GetParent] | ASSERTION: no placeholder frame for out-of-flow frame: 'Not Reached' | ASSERTION: How did that happen?: 'inFlowFrame'

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Bob Clary [:bc] (inactive)]

1.9.2 mac/windows at least. 1.9.3 mac doesn't crash.

1. http://www.sexdirectline.com/
2. 

###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h.  Unregistering ourselves, but this might cause our out-of-flow to be unable to destroy itself properly.  Not that it could anyway, with us dead.: 'Error', file /work/mozilla/builds/1.9.2/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 136
###!!! ASSERTION: frame was not removed from primary frame map before destruction or was readded to map after being removed: 'Not Reached', file /work/mozilla/builds/1.9.2/mozilla/layout/base/nsFrameManager.cpp, line 756
###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h.  Unregistering ourselves, but this might cause our out-of-flow to be unable to destroy itself properly.  Not that it could anyway, with us dead.: 'Error', file /work/mozilla/builds/1.9.2/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 136
###!!! ASSERTION: frame was not removed from primary frame map before destruction or was readded to map after being removed: 'Not Reached', file /work/mozilla/builds/1.9.2/mozilla/layout/base/nsFrameManager.cpp, line 756
###!!! ASSERTION: How did that happen?: 'inFlowFrame', file /work/mozilla/builds/1.9.2/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9078

3 crash.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x0000001c
0x18e3640b in nsIFrame::GetParent (this=0x0) at nsIFrame.h:733
733	  nsIFrame* GetParent() const { return mParent; }
#1  0x18e31ded in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval (this=0x1811b990, aFrame=0x1e8cdca0, aResult=0xbfffc974) at /work/mozilla/builds/1.9.2/mozilla/layout/base/nsCSSFrameConstructor.cpp:9079
#2  0x18e31244 in nsCSSFrameConstructor::RecreateFramesForContent (this=0x1811b990, aContent=0x16821d90, aAsyncInsert=0) at /work/mozilla/builds/1.9.2/mozilla/layout/base/nsCSSFrameConstructor.cpp:9196
#3  0x18e32a27 in nsCSSFrameConstructor::RestyleElement (this=0x1811b990, aContent=0x16821d90, aPrimaryFrame=0x1e8cdca0, aMinHint=nsChangeHint_ReconstructFrame) at /work/mozilla/builds/1.9.2/mozilla/layout/base/nsCSSFrameConstructor.cpp:7964
#4  0x18e32c70 in nsCSSFrameConstructor::ProcessOneRestyle (this=0x1811b990, aContent=0x16821d90, aRestyleHint=eReStyle_Self, aChangeHint=nsChangeHint_ReconstructFrame) at /work/mozilla/builds/1.9.2/mozilla/layout/base/nsCSSFrameConstructor.cpp:11657
#5  0x18e34ba0 in nsCSSFrameConstructor::ProcessPendingRestyles (this=0x1811b990) at /work/mozilla/builds/1.9.2/mozilla/layout/base/nsCSSFrameConstructor.cpp:11766
#6  0x18eaf337 in PresShell::FlushPendingNotifications (this=0x1811b560, aType=Flush_Style) at /work/mozilla/builds/1.9.2/mozilla/layout/base/nsPresShell.cpp:4875
#7  0x18e1da16 in nsCSSFrameConstructor::RestyleEvent::Run (this=0x181251b0) at /work/mozilla/builds/1.9.2/mozilla/layout/base/nsCSSFrameConstructor.cpp:11852

saved local version of page doesn't crash for me. :-(

Comment 1

[Bob Clary [:bc] (inactive)]

update crash bugs to critical per guidelines.

Comment 2

[Bob Clary [:bc] (inactive)]

1. http://fashion.rayli.com.cn/mixmatch/2011-05-11/L0002001010_846320_10.html#nextpic
2. Crash Nightly Mac/Linux/Windows

oodles of:
###!!! ASSERTION: no placeholder frame for out-of-flow frame: 'Not Reached', file /work/mozilla/builds/2.0.0/mozilla/layout/generic/nsFrame.cpp, line 6618

then:

###!!! ASSERTION: How did that happen?: 'inFlowFrame', file /work/mozilla/builds/2.0.0/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 8955

rogram received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x0000001c
0x04f9acf1 in nsIFrame::GetParent (this=0x0) at nsIFrame.h:796
796	  nsIFrame* GetParent() const { return mParent; }
(gdb) bt
#0  0x04f9acf1 in nsIFrame::GetParent (this=0x0) at nsIFrame.h:796
#1  0x04e1b7a0 in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval (this=0x1dd22be0, aFrame=0x21838cf0, aResult=0xbfffc3b0) at /work/mozilla/builds/2.0.0/mozilla/layout/base/nsCSSFrameConstructor.cpp:8956
#2  0x04e19211 in nsCSSFrameConstructor::RecreateFramesForContent (this=0x1dd22be0, aContent=0x21427450, aAsyncInsert=0) at /work/mozilla/builds/2.0.0/mozilla/layout/base/nsCSSFrameConstructor.cpp:9096
#3  0x04e19df6 in nsCSSFrameConstructor::ProcessRestyledFrames (this=0x1dd22be0, aChangeList=@0xbfffc49c) at /work/mozilla/builds/2.0.0/mozilla/layout/base/nsCSSFrameConstructor.cpp:7999
#4  0x04e1a650 in nsCSSFrameConstructor::RestyleElement (this=0x1dd22be0, aElement=0x21427450, aPrimaryFrame=0x21838cf0, aMinHint=0, aRestyleTracker=@0x1dd22c38, aRestyleDescendants=0) at /work/mozilla/builds/2.0.0/mozilla/layout/base/nsCSSFrameConstructor.cpp:8085
#5  0x04e0063a in mozilla::css::RestyleTracker::ProcessOneRestyle (this=0x1dd22c38, aElement=0x21427450, aRestyleHint=eRestyle_Self, aChangeHint=0) at /work/mozilla/builds/2.0.0/mozilla/layout/base/RestyleTracker.cpp:156

again, saved local version of page doesn't crash.

Comment 3

[Marcia Knous [:marcia]]

bc: smooney and I are going through old reproducible bugs. I am unable to repro this crash using the URL and the latest nightly on both Mac and Win XP. Are you still able to reproduce it?  Thanks.

Comment 4

[Bob Clary [:bc] (inactive)]

Tested with 1.9.2, Beta, Aurora and Nighty debug builds on Linux 32bit, Linux 64bit, Mac OS X 10.5 32bit, Mac OS X 10.6 32bit, Windows XP 32bit and Windows 7 32bit on 32bit and 32bit on 64bit and only reproduced the crash and assertion on Windows XP 1.9.2 http://www.sexdirectline.com/

I believe this was fixed by some of ehsan's patches. Perhaps bug 656130.

Comment 5

[(no longer active)]

(In reply to Bob Clary [:bc:] from comment #4)
> Tested with 1.9.2, Beta, Aurora and Nighty debug builds on Linux 32bit,
> Linux 64bit, Mac OS X 10.5 32bit, Mac OS X 10.6 32bit, Windows XP 32bit and
> Windows 7 32bit on 32bit and 32bit on 64bit and only reproduced the crash
> and assertion on Windows XP 1.9.2 http://www.sexdirectline.com/
> 
> I believe this was fixed by some of ehsan's patches. Perhaps bug 656130.

Bug 656130 is only fixed on trunk, and it was a fix to a regression caused by my patches in bug 10209 the first time that they landed.  So I doubt that I can take credit for this fix.  :-)