281657 - Crash with this testcase (derived from Adblock+Flashblock crash case) [@ nsBlockFrame::PullFrameFrom]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase. It crashes 100% reliably in current trunk builds for me.

Doesn't crash in Firefox build: 2004-08-09 06:48:00am
Does crash in Firefox build:    2004-08-10 06:47:00am
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2004-08-09+06%3A00%3A00&maxdate=2004-08-10+07%3A00%3A00&cvsroot=%2Fcvsroot
I guess this could be a regression from bug 230170.

Comment 1

[Martijn Wargers (dead)]

Attachment: xbl file for testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: framed page for testcase

Comment 3

[Martijn Wargers (dead)]

Attachment: Testcase (crashes on load)

This testcase crashes for me when loading.
Talkback ID: TB3589430H

Comment 4

[Martijn Wargers (dead)]

Attachment: framed page for testcase

I simplified it somewhat more.

Comment 5

[Martijn Wargers (dead)]

Attachment: Testcase (crashes on load)

Comment 6

[Martijn Wargers (dead)]

CC-ing Boris. See comment 0.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Well, my (clean!) debug build asserts but does not crash.

My opt build crashes in the middle of reflow, off a reflow event.

I'm really not sure what's going on here, but I'll look once bug 267833 is fixed...

Comment 8

[Martijn Wargers (dead)]

For the record, I've added the url where I crash. The crash on that site only
happens when I have both Adblock and Flashblock installed.

Comment 9

[OstGote!]

(In reply to comment #3)
> Created an attachment (id=173857) [edit]
> Testcase (crashes on load)
> 
> This testcase crashes for me when loading.
> Talkback ID: TB3589430H

Incident ID: 3589430
Stack Signature	nsBlockFrame::PullFrameFrom e9a79788
Product ID	FirefoxTrunk
Build ID	2005020601
Trigger Time	2005-02-09 07:07:20.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (0021be76)
URL visited	https://bugzilla.mozilla.org/show_bug.cgi?id=281173
User Comments	
Since Last Crash	7 sec
Total Uptime	38925 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2849
Stack Trace 	
nsBlockFrame::PullFrameFrom 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2849]
nsBlockFrame::PullFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2812]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3852]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3708]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2733]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2244]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 834]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3437]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2614]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2244]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 834]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 961]
CanvasFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 544]
nsFrame::BoxReflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5382]
nsFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5122]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 803]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 803]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1668]
nsHTMLScrollFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 582]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 803]
nsHTMLScrollFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 510]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 961]
ViewportFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 248]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 907]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6290]
ReflowEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6116]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
0x778b0c24

Comment 10

[Ben Fowler]

Attachment: Stack for this bug

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050227
Firefox/1.0+

This is still in. The last testcase crashed with this stack.

Comment 11

[Robin Monks]

*** Bug 281605 has been marked as a duplicate of this bug. ***

Comment 12

[Ben Fowler]

Attachment: Spackle

Spackle. This patch stops the crash for me

Comment 13

[Mats Palmgren (inactive)]

All testcases and URL worksforme in SeaMonkey 2005-08-19-01 trunk Linux.
(also works in a Linux debug build)

Comment 14

[Martijn Wargers (dead)]

Yes, this is WFM with the latest nightly trunk build.
It crashes with a 2005-07-01 trunk build.