282933 - Page crashes Firefox [@ nsObjectFrame::PluginNotAvailable ]

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Jerry Baker]

20050217 trunk

http://www.wrongdiagnosis.com/ crashes FF. Talkback IDs:

TB3822630M
TB3822614Y

Comment 1

[Olivier Cahagne]

nsObjectFrame::PluginNotAvailable 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 3105]
nsPluginInstanceOwner::PluginNotAvailable 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 2689]
nsPluginHostImpl::SetUpPluginInstance 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp,
line 3714]
nsPluginHostImpl::InstantiateEmbededPlugin 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp,
line 3408]
nsObjectFrame::InstantiatePlugin 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 1408]
nsObjectFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsObjectFrame.cpp,
line 1255]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 999]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 4102]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3792]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3681]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2716]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2227]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 820]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3410]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2597]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2227]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 820]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 957]
CanvasFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 522]
nsFrame::BoxReflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5324]
nsFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5066]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1624]
nsXULScrollFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 560]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsHTMLScrollFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 488]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 957]
ViewportFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 240]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 907]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6320]
ReflowEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6146]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
0x778b0c24
nsDocShell::FindTarget 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/docshell/base/nsDocShell.cpp,
line 1142]
0x244c8b5d

Comment 2

[Behrooz Shahriari]

works for me

Comment 3

[timeless]

i'm betting GetDocument() returned null

Comment 4

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050218 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050218

Right click on links in the content area acts like left click, loads link
directly. Right click on links in the google ad area opens context menu.

Plugins installed:
Firefox: Windows Media Player, Acrobat
Mozilla: Windows Media Player

Comment 5

[Hermann Schwab]

retested on another computer, Flash and Java installed, PopUps blocked, then
enabled, and my ad-blocking hosts file disabled.

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050221
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050217 Firefox/1.0+
wfm Mozilla/5.0 (Windows; U; Win98; de-DE; rv:1.7.5) Gecko/20041108 Firefox/1.0

Jerry, do you use adblocking or flashblocking extensions?

Comment 6

[Jerry Baker]

Flashblock. But, the crashes didn't start till I updated from 20050210 trunk to
20050217.

Comment 7

[Hermann Schwab]

(In reply to comment #6)
> Flashblock. But, the crashes didn't start till I updated from 20050210 trunk to
> 20050217.

Problem is flashblock-related, couldn´t install it in FF-Trunk, but after
installing Flashblock in FF1.0 I could crash with FF-trunk.

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050218 Firefox/1.0+

Can´t install Flashblock:
Flashblock 1.2.9, Last Update: February 13, 2005 10:34:28am
https://addons.update.mozilla.org/extensions/moreinfo.php?application=firefox&version=1.0&os=Windows&category=Web%20Annoyances&numpg=10&id=433

I´ve got a nice collection of some zip builds, each in it´s own directory, to be
able to test different builds. So this build isn´t registered in the windows
registry.

It installed however in my regular exe-installed 
Mozilla/5.0 (Windows; U; Win98; de-DE; rv:1.7.5) Gecko/20041108 Firefox/1.0

As I didn´t easily find flash on http://www.wrongdiagnosis.com/ I followed some
ads, got to http://de.tickle.com/test/iq/intro.html

FF1.0 was showing rectangulars with borders, containing a something like a Flash
logo, clicking on this, Flash was displayed. Sorry, I don´t know  flash
blockers, just installed for test.

Started 20050218 trunk nightly using the same profile, and going to extensions,
Flashblock was shown. Loading the URL, Flash was shown. Clearing the (empty)
whitelist didn´t help. 

Loading http://www.wrongdiagnosis.com/ gives instant crash.

TB3848839G nsObjectFrame::PluginNotAvailable  

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3848839G

Comment 8

[Boris Zbarsky [:bzbarsky]]

We have existing flashblock crashes on file... that code does some weird stuff.

Comment 9

[Hermann Schwab]

Using mozilla, I saved http://www.wrongdiagnosis.com/ as webpage, complete, and 
then loaded it into Firefox. No crash, but a banner telling me that the site
needs additional plugins. I followed the link, told me I need flash.
As I´ve got flash, I didn´t install, but aborted. Loaded the flash link I found
in an ad, http://de.tickle.com/test/iq/intro.html, flash was seen.

The facts:
1. without Flashblock installed, FF1.0 and current Trunk nightly don´t crash.
2. Flashblock can be installed on 1.0 and works on 1.0
   Flashblock can´t be installed on trunk, 
   but installed Flashblock is seen on Trunk, but doesn´t work.
3. random flashsite http://de.tickle.com/test/iq/intro.html
   flashblock works on 1.0, doesn´t work on trunk but shows flash.
4. this bugs site http://www.wrongdiagnosis.com/
   I didn´t see flash on the site, only some animated gifs,
   but site immediately crashs using a current FF trunk nightly with a rather  
       clean FF1.0 profile. I didn´t see extensions installed, it was the first
time I installed an adblocking extension. (a hosts file doesn´t generate
bugzilla entries ;-)
5. made a local copy of http://www.wrongdiagnosis.com/
   does load on Mozilla, 
   does load on Firefox Trunk, but asks for missing plugins, following the link
to the plugins site you can see flash is needed, but newest flash is available
in this profile, as can be seen, if you load another URL, as noted before.

So without flashblock installed it doesn´t crash, though I don´t see flash,
with flashblock installed using 1.0 FF trunk crashes online, but asks for
installing flash offline. No problem seeing the local copy with current nightly
of mozilla, but my mozilla doesn´t have flash installed, as I don´t like it,
rarely need it.

Comment 10

[Philip Chee]

This is a WORKSFORME with the current Flashblock 1.3.3alpha on the following platforms:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051017 Firefox/1.4.1
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051017 Firefox/1.6a1
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051024 SeaMonkey/1.1a

NB: there is a roatating banner advertisement that is only very rarely flash. You'll need to refresh like forever before one shows up. Unless someone comes up with a reduced test case, it's unlikely this bug will go anywhere.

Comment 11

[Christopher Aillon (sabbatical, not receiving bugmail)]

Just saw this stack filed again in RH Bugzilla.  https://bugzilla.redhat.com/231773

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: So, does this help?

Comment 13

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Better version

This is essentially the same as the previous patch, except that it sets mIsBrokenPlugin even when its content isn't in a document.

Note: see the RedHat bug for what appears to be confirmation of timeless's comment 3.

Comment 14

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 258505 [details] [diff] [review]
Better version

we've got frames with content that's not in a document? I'd like a layout peer to look at this too.

Comment 15

[Boris Zbarsky [:bzbarsky]]

> we've got frames with content that's not in a document?

Thanks to nsDocument::Destroy and paint suppression, this can in fact happen... rarely.

Comment 16

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 258505 [details] [diff] [review]
Better version

Looks ok, but add a comment in nsDocument::Destroy pointing out that this should be reverted once that function is gone?

Comment 17

[Blake Kaplan (:mrbkap) (inactive)]

I should have mentioned: this patch is necessarily against the 1.8 branch (the trunk code is completely different). I'll add the comment, but I don't think there's too much chance of nsDocument::Destroy going away on the branch.

Comment 18

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 258505 [details] [diff] [review]
Better version

Looking to check this in on branches. It is impossible to check this in on trunk first and the patch itself is a simple null-check.

Comment 19

[Boris Zbarsky [:bzbarsky]]

Oh.  On branch, no need for that comment, yeah.

Comment 20

[Christopher Aillon (sabbatical, not receiving bugmail)]

(In reply to comment #12)
> Created an attachment (id=258502) [details]
> So, does this help?

Yep.  I produced an RPM for the reporter including the subsequent patch and he confirms it makes the problem go away.

Comment 21

[Daniel Veditz [:dveditz]]

Comment on attachment 258505 [details] [diff] [review]
Better version

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 22

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into all relevant branches.

Comment 23

[Marcia Knous [:marcia]]

verified on the 1.8 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4pre) Gecko/2007050804 BonEcho/2.0.0.4pre. I installed Flashblock and played around on wrongdiagnosis.com, and no issues with crashing. Adding branch verified keyword.

Comment 24

[Marcia Knous [:marcia]]

verified on the 1.8.0 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.12pre) Gecko/20070508 Firefox/1.5.0.12pre. I installed
Flashblock and played around on wrongdiagnosis.com, and no issues with
crashing. Adding branch verified keyword.