Closed Bug 1264921 Opened 4 years ago Closed 3 years ago

RecursiveCall cf5.c76.ef5.ef5.7f7.2eb.255.2d6.2eb @ firefox.exe!xul.dll!PrepareEditorEvent::Run

Categories

(Core :: Layout, defect, P3, critical)

45 Branch
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: abbGZcvu_bugzilla.mozilla.org, Unassigned)

Details

(Keywords: crash, csectype-dos, testcase)

Attachments

(2 files)

Attached file Repro
Repro:

    <body style=display:table-footer-group onload=d=document;h=d.all[0];h.appendChild(d.createElement("input"));h.appendChild(d.createElement("iframe"));d.designMode="on">

Recursion loop:
xul.dll!PrepareEditorEvent::Run + 0x38 (cf5 in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\dom\html\nstexteditorstate.cpp @ 1100]
xul.dll!nsAutoScriptBlocker::~nsAutoScriptBlocker + 0x6D (c76 in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\dom\base\nscontentutils.h @ 2744]
xul.dll!PresShell::FlushPendingNotifications + 0x174 (ef5 in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\layout\base\nspresshell.cpp @ 4078]
xul.dll!PresShell::FlushPendingNotifications + 0x1D (ef5 in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\layout\base\nspresshell.cpp @ 3954]
xul.dll!nsHideViewer::Run + 0x1D (7f7 in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\layout\generic\nssubdocumentframe.cpp @ 953]
xul.dll!nsContentUtils::RemoveScriptBlocker + 0x6F (2eb in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\dom\base\nscontentutils.cpp @ 5139]
xul.dll!nsHTMLEditRules::DocumentModifiedWorker + 0xAD (255 in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\editor\libeditor\nshtmleditrules.cpp @ 9051]
xul.dll!nsRunnableMethodImpl<void (__thiscall nsDocument::*)(void),1>::Run + 0x15 (2d6 in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\dist\include\nsthreadutils.h @ 872]
xul.dll!nsContentUtils::RemoveScriptBlocker + 0x6F (2eb in id) [c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\dom\base\nscontentutils.cpp @ 5139]
Severity: critical → normal
Crash due to infinite recursion, here's recurring part of the stack:
...
nsAutoScriptBlocker::~nsAutoScriptBlocker dom/base/nsContentUtils.h:2718
nsAutoScriptBlockerSuppressNodeRemoved::~nsAutoScriptBlockerSuppressNodeRemoved dom/base/nsContentUtils.h:2732
nsHTMLEditRules::DocumentModifiedWorker editor/libeditor/nsHTMLEditRules.cpp:9096
nsRunnableMethodArguments<>::applyImpl<nsHTMLEditRules, ... nsThreadUtils.h:671
nsRunnableMethodArguments<>::apply<nsHTMLEditRules, ... nsThreadUtils.h:677
nsRunnableMethodImpl<void (nsHTMLEditRules::*)(), true>::Run nsThreadUtils.h:705
nsContentUtils::RemoveScriptBlocker () dom/base/nsContentUtils.cpp:4985
nsAutoScriptBlocker::~nsAutoScriptBlocker dom/base/nsContentUtils.h:2718
PrepareEditorEvent::Run dom/html/nsTextEditorState.cpp:1118
nsContentUtils::RemoveScriptBlocker () dom/base/nsContentUtils.cpp:4985
nsAutoScriptBlocker::~nsAutoScriptBlocker dom/base/nsContentUtils.h:2718
PresShell::FlushPendingNotifications layout/base/nsPresShell.cpp:4065
PresShell::FlushPendingNotifications (aType=Flush_Style) layout/base/nsPresShell.cpp:3952
nsHideViewer::Run (this=0x7f6209b26b00) layout/generic/nsSubDocumentFrame.cpp:947
nsContentUtils::RemoveScriptBlocker () dom/base/nsContentUtils.cpp:4985
...
Severity: normal → critical
Component: DOM: Core & HTML → Layout
Keywords: csectype-dos
Priority: -- → P3
Looks like this got fixed at some point.  Landed the crashtest.
Status: NEW → RESOLVED
Closed: 3 years ago
Flags: in-testsuite+
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.