346521 - Crash [@ PresShell::ReflowEvent::Run] when clicking on close window link in popup window with embedded video

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Martijn Wargers (dead)]

This is a crash I see with current trunk builds, I haven't looked for a regression window, yet.

To reproduce:
- Open http://edition.cnn.com/
- Click on one of the video links in the Video section (at the right column, it's flash part, clicking on the links may be difficult, because of bug 311622)
- A popup window opens, let the window open for a few seconds
- Click on the close window link at the top right

Result:
crash

Talkback ID: TB21585055K
PresShell::ReflowEvent::Run   nsThread::ProcessNextEvent   NS_ProcessPendingEvents_P   nsBaseAppShell::NativeEventCallback   USER32.dll + 0x8734 (0x77d18734)
USER32.dll + 0x8816 (0x77d18816)
USER32.dll + 0x89cd (0x77d189cd)
USER32.dll + 0x8a10 (0x77d18a10)
wmp.dll + 0x155f14 (0x07665f14)
wmp.dll + 0x15c20c (0x0766c20c)
wmp.dll + 0x15c1e9 (0x0766c1e9)
wmp.dll + 0x224543 (0x07734543)
wmp.dll + 0x2249ea (0x077349ea)
wmp.dll + 0x16acf4 (0x0767acf4)
wmpdxm.dll + 0x2440f (0x08a1440f)
npdsplay.dll + 0x17b2e (0x05ec7b2e)
npdsplay.dll + 0xcea8 (0x05ebcea8)
npdsplay.dll + 0x1090d (0x05ec090d)
ns4xPluginInstance::Stop   nsObjectFrame::StopPlugin   nsObjectFrame::Destroy   nsLineBox::DeleteLineList   nsLineBox::DeleteLineList   nsFrameList::DestroyFrames   CanvasFrame::Destroy   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameManager::Destroy   DocumentViewerImpl::Hide   nsDocShell::SetVisibility   nsLineBox::DeleteLineList   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsLineBox::DeleteLineList   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsLineBox::DeleteLineList   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   CanvasFrame::Destroy   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameManager::Destroy   DocumentViewerImpl::Hide   nsDocShell::SetVisibility   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameList::DestroyFrames   nsFrameManager::Destroy   DocumentViewerImpl::Destroy   nsDocShell::Destroy

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Null check

According to TB the crashes (#37) happen when viewManager is null.
And it can be null when presshell::destroy has been called.
Similar thing also in line http://lxr.mozilla.org/seamonkey/source/layout/base/nsPresShell.cpp#6555

Comment 2

[Martijn Wargers (dead)]

I've tried the patch in my trunk debug build and it indeed seems to fix the crash.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Er... so wasn't this a duplicate of bug 347662 (except for being reproducible on trunk)?  We should fix the real problem instead of just blindly null-checking, imo.  For example, if we need to move the code on trunk too we should do that.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #3)
> Er... so wasn't this a duplicate of bug 347662 (except for being reproducible
> on trunk)? 

ah, I wasn't aware of bug 347662.