666751 - Crashing on mail.yandex.ru/lenta (RSS reader)

Status: RESOLVED FIXED

(Core :: Layout: Block and Inline, defect)

Description

[Yakove]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; rv:7.0a1) Gecko/20110623 Firefox/7.0a1
Build Identifier: Mozilla/5.0 (Windows NT 6.1; rv:7.0a1) Gecko/20110623 Firefox/7.0a1

2011/06/23 crashes on 20110623 http://mail.yandex.ru/lenta

Reports:
https://crash-stats.mozilla.com/report/index/bp-85abffa9-1b77-4dcd-b6a5-d6a352110623
https://crash-stats.mozilla.com/report/index/bp-4fea2d00-bcf1-4917-a88c-281dc2110623
https://crash-stats.mozilla.com/report/index/bp-862184bb-61c9-41ef-9124-1d3f52110623

On yesterday's build no crashes

Reproducible: Always

Steps to Reproduce:
1. Go to http://mail.yandex.ru/lenta (need an yandex account and couple of 
rss feeds there)
2. Crash


Actual Results:  
Browser crashes

Expected Results:  
No crashes

Comment 1

[Thomas Ahlblom]

0 	xul.dll 	nsLayoutUtils::GetCrossDocParentFrame 	layout/base/nsLayoutUtils.cpp:475
1 	xul.dll 	mozilla::css::IsFrameDescendantOfAny 	layout/generic/TextOverflow.cpp:184
2 	xul.dll 	mozilla::css::TextOverflow::PruneDisplayListContents 	layout/generic/TextOverflow.cpp:516
3 	xul.dll 	mozilla::css::TextOverflow::ProcessLine 	layout/generic/TextOverflow.cpp:502
4 	xul.dll 	DisplayLine

Comment 2

[Mats Palmgren (inactive)]

Attachment: fix

I'm pretty sure this will fix it.

Still, I'd really like to have a look at frame tree / display items
when this crash occurs.

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase

It's not completely minimized yet, working on it.

Comment 4

[Martijn Wargers (dead)]

Attachment: testcase

This is more or less minimized.

Comment 5

[Mats Palmgren (inactive)]

Thanks Martijn!  I can reproduce the crash, investigating...

Comment 6

[Mats Palmgren (inactive)]

Attachment: Frame dump

It's a display item for a fixed pos. frame.  Hmm, I didn't expect that there,
I thought those would end up on their containing block's display lists.
Oh well, the attached null-check should fix it.

Comment 7

[Mats Palmgren (inactive)]

Attachment: crash tests

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 541534 [details] [diff] [review]
fix

Review of attachment 541534 [details] [diff] [review]:
-----------------------------------------------------------------

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 541566 [details] [diff] [review]
crash tests

Review of attachment 541566 [details] [diff] [review]:
-----------------------------------------------------------------

Comment 10

[Yakove]

Please land it!

Comment 11

[Mats Palmgren (inactive)]

(In reply to comment #10)
> Please land it!

Hey, no need to be rude!  FYI, comments like that *never* helps.

Comment 12

[Rob Tonsan]

Implying that he is rude...
Implying that you not spam this bug (like me now)...

Comment 13

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/0e4fb0226589
http://hg.mozilla.org/mozilla-central/rev/4f032c2cc14e

Comment 14

[Marcia Knous [:marcia]]

Adding Mac signature so it gets picked up in crash stats.

Comment 15

[Axel Hecht]

https://crash-stats.mozilla.com/report/index/bp-cd2fdd6e-dee9-42dd-b8b1-93fae2120702 pointed me to this bug, build id is 20120702030551