344909 - Crash [@ CantRenderReplacedElementEvent::CantRenderReplacedElementEvent] on 1.8 branch with setting javascript src on embed

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes current 1.8 branch builds, but not trunk builds.
Talkback ID: TB21031256X
CantRenderReplacedElementEvent::CantRenderReplacedElementEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 3978]
nsObjectFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsObjectFrame.cpp, line 1262]
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsLineLayout.cpp, line 996]
nsBlockFrame::ReflowInlineFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 4200]
nsBlockFrame::DoReflowInlineFrames  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3853]
nsBlockFrame::ReflowInlineFrames  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3735]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2729]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2263]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 904]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3449]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2610]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2263]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 904]
nsBlockReflowContext::ReflowBlock  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 606]
nsBlockFrame::ReflowBlockFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3449]
nsBlockFrame::ReflowLine  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2610]
nsBlockFrame::ReflowDirtyLines  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2263]
nsBlockFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 904]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
CanvasFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 536]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
nsHTMLScrollFrame::ReflowScrolledFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 523]
nsHTMLScrollFrame::ReflowContents  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 571]
nsHTMLScrollFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 769]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 905]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 240]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 914]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6882]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6708]
PL_HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/xpcom/threads/plevent.c, line 689]
0x778b0c24
0x00200064
0xeed9285e

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes on load)

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase2

Slighty different testcase, it gives the same stacktrace.
With this testcase, the embed is moved to a different document.

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase2

Slighty different testcase, it gives the same stacktrace.
With this testcase, the embed is moved to a different document.

Comment 4

[Martijn Wargers (dead)]

Attachment: testcase3

similar testcase as testcase2, but now using <object>. This gives the same stack in 1.8 builds as previous testcases.

Comment 5

[Boris Zbarsky [:bzbarsky]]

So this looks basically like 136927.  :(

Comment 6

[Christian :Biesinger (don't email me, ping me on IRC)]

(that's bug 136927, for linkification purposes)

Comment 7

[:Gavin Sharp [email: [e-mail]]]

I can't reproduce a crash using any of those testcases, with opt or debug Mac branch builds. Could this be either Windows-only or WFM?

Comment 8

[:Gavin Sharp [email: [e-mail]]]

(to be clear, I was testing 1.8 (MOZILLA_1_8_BRANCH) branch builds, not 1.8.0)

Comment 9

[:Gavin Sharp [email: [e-mail]]]

I can't reproduce this on Windows branch builds (debug/opt) either .

Martijn, WFM?

Comment 10

[Martijn Wargers (dead)]

Yes, all the testcases are wfm now with a recentish branch build.
I'm also not crashing with a 2007-01-07 branch build. So this doesn't crash anymore on released branch builds, so I'm opening this one up.