319332 - Infinite recursion via nsObjectFrame::NotifyContent hangs trunk

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

The browser hung and I got a stack like this (repeated over and over of course):

#92 0x00002aaab07ed57e in nsObjectFrame::NotifyContentObjectWrapper (
    this=0x268b318) at nsObjectFrame.cpp:1822
#93 0x00002aaab07ed78d in nsObjectFrame::Instantiate (this=0x268b318,
    aMimeType=0x2725608 "application/x-shockwave-flash", aURI=0x135d5a0)
    at nsObjectFrame.cpp:1699
#94 0x00002aaab09e61c9 in nsObjectLoadingContent::Instantiate (this=0x135d038,
    aMIMEType=@0x135d0b8, aURI=0x135d5a0) at nsObjectLoadingContent.cpp:1343
#95 0x00002aaab09e6f11 in nsObjectLoadingContent::EnsureInstantiation (
    this=0x135d038, aInstance=0x7ffff7fb46b0) at nsObjectLoadingContent.cpp:573
#96 0x00002aaab0c0aa26 in nsHTMLExternalObjSH::GetPluginInstance (
    this=0xab4da0, wrapper=0x12ba1d0, _result=0x7ffff7fb46b0)
    at nsDOMClassInfo.cpp:8551
#97 0x00002aaab0c12dab in nsHTMLExternalObjSH::PostCreate (this=0xab4da0,
    wrapper=0x12ba1d0, cx=0x23c1b80, obj=0x2aaab94e3e10)
    at nsDOMClassInfo.cpp:8589
#98 0x00002aaab07ed57e in nsObjectFrame::NotifyContentObjectWrapper (
    this=0x268b318) at nsObjectFrame.cpp:1822

Sorry but I don't know the URL I was at. I actually don't have a Flash plugin on this machine (64bit).

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: I _think_ this should fix it

The only way I can see for that recursion to happen is for InstantiatePlugin to return success without setting up a plugin instance... not sure how that can happen, but there are lots of null-checks in the plugin host that indicate that it's possible. :(

Comment 2

[Boris Zbarsky [:bzbarsky]]

Fixed.