117118 - MacOS 9 crash on http://www.nana.co.il/

Status: RESOLVED DUPLICATE of bug 117703

(Core :: Layout: Text and Fonts, defect)

Description

[Frank Tang]

I have the patch 116976 in my tree and when I visit http://www.nana.co.il/ it 
first get assertion and then it crash. I should try to reproduce without the 
patch and see what happen:
here is the stack when it assert

FrameManager::HandlePLEvent(CantRenderReplacedElementEvent*)
contentDebug.shlb 0x3CCC4778 (PPC)
nsCSSFrameConstructor::CantRenderReplacedElement(nsIPresShell*,nsIPresContext*
,nsIFrame*)
FrameManager::ReplaceFrame(nsIPresContext*,nsIPresShell&,nsIFrame*,nsIAtom*
,nsIFrame*,nsIFrame*)
nsContainerFrame::ReplaceFrame(nsIPresContext*,nsIPresShell&,nsIAtom*,nsIFrame*
,nsIFrame*)
nsBlockFrame::RemoveFrame(nsIPresContext*,nsIPresShell&,nsIAtom*,nsIFrame*)
nsBlockFrame::DoRemoveFrame(nsIPresContext*,nsIFrame*)
nsObjectFrame::Destroy(nsIPresContext*)
nsContainerFrame::Destroy(nsIPresContext*)
nsFrame::Destroy(nsIPresContext*)
PresShell::NotifyDestroyingFrame(nsIFrame*)
FrameManager::NotifyDestroyingFrame(nsIFrame*)
nsDebug::Assertion(const char*,const char*,const char*,int)
dprintf(const char*,...)
InterfaceLib 0xFFD03A30 (PPC)

The assertino in FrameManager::NotifyDestroyingFrame(nsIFrame*)

    NS_ASSERTION(!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame,
                 "frame was not removed from primary frame map before"
                 "destruction or was readded to map after being removed");

where aFrame == 0x0978BEC0
entry->frame == 0x0978BEC0

and then I continue, and it got "illegal exception instruction" and crash in

the following stack:


nsCSSFrameConstructor::ProcessChildren(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,int,nsFrameItems&
,int,nsTableCreator*)
nsCSSFrameConstructor::ConstructFrame(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsFrameItems&)
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsIAtom*,int,nsIStyleContext*
,nsFrameItems&,int)
nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,const nsStyleDisplay*,nsIContent*,nsIFrame*
,nsIStyleContext*,nsFrameItems&)
nsCSSFrameConstructor::ConstructTableFrame(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsIStyleContext*,nsTableCreator&
,int,nsFrameItems&,nsIFrame*&,nsIFrame*&,int&)
nsCSSFrameConstructor::TableProcessChildren(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsTableCreator&,nsFrameItems&
,nsIFrame*&)
nsCSSFrameConstructor::TableProcessChild(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIContent*,nsIFrame*,nsIAtom*
,nsIStyleContext*,nsTableCreator&,nsFrameItems&,nsIFrame*&)
nsCSSFrameConstructor::ConstructTableRowGroupFrame(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsIStyleContext*,nsTableCreator&
,int,nsFrameItems&,nsIFrame*&,int&)
nsCSSFrameConstructor::TableProcessChildren(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsTableCreator&,nsFrameItems&
,nsIFrame*&)
nsCSSFrameConstructor::TableProcessChild(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIContent*,nsIFrame*,nsIAtom*
,nsIStyleContext*,nsTableCreator&,nsFrameItems&,nsIFrame*&)
nsCSSFrameConstructor::ConstructTableRowFrame(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsIStyleContext*,nsTableCreator&
,int,nsFrameItems&,nsIFrame*&,int&)
nsCSSFrameConstructor::TableProcessChildren(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsTableCreator&,nsFrameItems&
,nsIFrame*&)
nsCSSFrameConstructor::TableProcessChild(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIContent*,nsIFrame*,nsIAtom*
,nsIStyleContext*,nsTableCreator&,nsFrameItems&,nsIFrame*&)
nsCSSFrameConstructor::ConstructTableCellFrame(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsIStyleContext*,nsTableCreator&
,int,nsFrameItems&,nsIFrame*&,nsIFrame*&,int&)
nsCSSFrameConstructor::ProcessChildren(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,int,nsFrameItems&
,int,nsTableCreator*)
nsCSSFrameConstructor::ConstructFrame(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsFrameItems&)
nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,nsIContent*,nsIFrame*,nsIAtom*,int,nsIStyleContext*
,nsFrameItems&,int)
nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*,nsIPresContext*
,nsFrameConstructorState&,const nsStyleDisplay*,nsIContent*,nsIFrame*
,nsIStyleContext*,nsFrameItems&)
FrameManager::SetPrimaryFrameFor(nsIContent*,nsIFrame*)
PL_DHashTableOperate
ChangeTable
PrimaryFrameMapGetKey(PLDHashTable*,PLDHashEntryHdr*)
0xFFC10000 (PPC)

and in 
PrimaryFrameMapGetKey(PLDHashTable *table, PLDHashEntryHdr *hdr)
{
  PrimaryFrameMapEntry *entry = NS_STATIC_CAST(PrimaryFrameMapEntry*, hdr);
  nsCOMPtr<nsIContent> content;


(*entry).frame is 0x0978BEC0

notice the frame is the same frame left over last time.
I think it is an invalid entry which does not get removed last time.

Comment 1

[Frank Tang]

reassign to ftang

Comment 2

[Frank Tang]

same crash happen w/o the patch in bug 116976 

Comment 3

[Boris Zbarsky [:bzbarsky]]

This stack looks just like the one in bug 117703, so this may not be a BIDI 
issue...

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Like bug 117703, the element in question is an object element and it seems that
the frame was never removed from the map rather than that it was readded.

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

*** This bug has been marked as a duplicate of 117703 ***