Closed Bug 287124 Opened 19 years ago Closed 19 years ago

Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ][@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(4 keywords)

Crash Data

Attachments

(2 files)

Flash file for testcase
1.81 KB, application/x-shockwave-flash
Details
Testcase
822 bytes, text/html
Details 
See upcoming testcase.
When hovering a couple of times over the div, you should not get a crash.

It seems a regression, it does not crash with:
2005-02-22 07:27am
It does crash with:
2005-02-23 07:24am
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-22+05%3A00%3A00&maxdate=2005-02-23+08%3A00%3A00&cvsroot=%2Fcvsroot

    
    

    
  

      
      
      
      

        Attached file
          
        Testcase
        — 
      

    


  

    
    

    
  
Talkback ID: TB4507303Y

0x00000000
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 1144]
nsInlineFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 712]
nsInlineFrame::ReflowFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 530]
nsInlineFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 444]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 999]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 4115]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3805]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3694]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2729]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2240]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 833]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3423]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2610]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2240]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 833]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 954]
CanvasFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 522]
nsFrame::BoxReflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5361]
nsFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5103]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 954]
ViewportFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 240]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 907]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6435]
PresShell::WillPaint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6193]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
SHELL32.dll + 0x520c24 (0x778b0c24)

    
  
Summary: Crash when div:hover {display:none} with inside iframe with flash embed → Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ]

    
    

    
  
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050321
Crash Occurs w/this build also.  Talkback ID: TB4500717W

    
    

    
  
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050322

1. I don´t have flash installed
2. saved testcase, removed link to flash, removed link to macromedia, removed
parameters, so only <Object> and <embed> were seen, 
Then tested locally to produce first talkback below.
Second Talkback produced with attached testcase loaded from here, both TBs are
identical for 26 lines, differ only slightly in the topmost line, as one was
including the macromedia URL, the other one no URLs at all.


http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4531133Z
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4531202H

    
    

    
  
TB4500717W:
0x00000000
nsCSSFrameConstructor::CantRenderReplacedElement 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 10853]
nsFrameManager::HandlePLEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsFrameManager.cpp,
line 873]
SETUPAPI.DLL + 0x30c24 (0x778b0c24)
Summary: Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ] → Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ][@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]

    
    

    
  
I get a crash (eventually) because somehow a presshell is destroyed while in the
middle of reflow...  I don't see anything in the range listed in comment 0 that
seems related, though.  :(
Flags: blocking1.8b2?
Flags: blocking-aviary1.1?
Keywords: helpwanted

    
    

    
  
jay is this showing up in top crash data?


    
    

    
  
I definitely see a few crashes with that stack, but it doesn't appear to be a
topcrash.  Still, I was able to reproduce this, so we should probably get some
eyes on it.


    
    

    
  
For the record, this is not a problem on the Aviary branch.  No crash with
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050406
Firefox/1.0.3

    
    

    
  
Talkback is broken with recent nightlies, so as soon as we get that fixed, I'll
post a recent incident here.

    
    

    
  
My crash with today's build looks about the same as comment #3, just updated
line nos.:

Incident ID: 4947989
Stack Signature	0x00000000 3f90a6aa
Email Address	jay@mozilla.org
Product ID	FirefoxTrunk
Build ID	2005040813
Trigger Time	2005-04-08 15:21:58.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	https://bugzilla.mozilla.org/show_bug.cgi?id=287124
User Comments	hovering over iframe border (test case in
https://bugzilla.mozilla.org/show_bug.cgi?id=287124)
Since Last Crash	58 sec
Total Uptime	58 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x00000000
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 1148]
nsInlineFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 712]
nsInlineFrame::ReflowFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 530]
nsInlineFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 444]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 999]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 4178]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3831]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3714]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2701]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 875]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 571]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3431]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2582]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 875]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 908]
CanvasFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 522]
nsFrame::BoxReflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5391]
nsFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5133]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsGfxScrollFrameInner::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1937]
nsXULScrollFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1010]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsXULScrollFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 958]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 908]
ViewportFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 240]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 908]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6648]
PresShell::WillPaint 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6406]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
0x778b0c24
nsPrefetchService::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/prefetch/nsPrefetchService.cpp,
line 418]
0xc25dffeb

    
  
Flags: blocking1.8b3?
Flags: blocking1.8b2?
Flags: blocking1.8b2-

    
    

    
  
wfm winxp seamonkey 2005060306 with flash

    
  
Flags: blocking1.8b3? → blocking1.8b3-

    
    

    
  
transferring nomination to 1.8b4. If we don't get it there, we don't get it for 1.1
Flags: blocking-aviary1.1? → blocking1.8b4?

    
  
Flags: blocking1.8b4? → blocking1.8b4-

    
    

    
  
This is worth retesting now that bug 1156 is fixed, since
CantRenderReplacedElement is now gone.
Depends on: 1156

    
    

    
  
To be honest, I think this is already fixed somehow.
I can't get it to crash with the 2005-09-20 trunk build (although, I know it was
a bit difficult to crash).
Marking WFM?

    
    

    
  
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050921 SeaMonkey/1.1a

retested with testcase from URL and local testcases I made in comment 5 with and
without flash installed, no crash.

    
    

    
  
WFM seems perfectly fine if it is.  ;)

    
  
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ 0x00000000 - nsLineLayout::ReflowFrame ]
[@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: