395538 - Crash [@ nsLayoutUtils::GetParentOrPlaceholderFor] with flash embed, display: table-stuff, overflow: scroll and binding with position: fixed

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which usually crashes with current trunk build after 500ms.

This seems to have regressed between 2007-01-19 and 2007-01-21:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-07-19+03&maxdate=2007-07-21+06&cvsroot=%2Fcvsroot
Regression from bug 347639, somehow? (if that makes sense)

http://crash-stats.mozilla.com/report/index/ace73acc-5e5a-11dc-853f-001a4bd43ed6
0  	nsLayoutUtils::GetParentOrPlaceholderFor(nsFrameManager*, nsIFrame*)  	 mozilla/layout/base/nsLayoutUtils.cpp:1137
1 	FillAncestors 	mozilla/layout/base/nsLayoutUtils.cpp:379
2 	nsLayoutUtils::DoCompareTreePosition(nsIFrame*, nsIFrame*, int, int, nsIFrame*) 	mozilla/layout/base/nsLayoutUtils.cpp:415
3 	nsLayoutUtils::CompareTreePosition(nsIFrame*, nsIFrame*, nsIFrame*) 	mozilla/layout/base/nsLayoutUtils.h:188
4 	nsFrameConstructorState::ProcessFrameInsertions(nsAbsoluteItems&, nsIAtom*) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:1504
5 	nsFrameConstructorState::~nsFrameConstructorState() 	mozilla/layout/base/nsCSSFrameConstructor.cpp:1249
6 	nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent*, int, nsILayoutHistoryState*) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9184
7 	nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:11080
8 	nsCSSFrameConstructor::RestyleElement(nsIContent*, nsIFrame*, nsChangeHint) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9940
9 	nsCSSFrameConstructor::ProcessOneRestyle(nsIContent*, nsReStyleHint, nsChangeHint) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:12965
10 	nsCSSFrameConstructor::ProcessPendingRestyles() 	mozilla/layout/base/nsCSSFrameConstructor.cpp:13018
11 	PresShell::DoFlushPendingNotifications(mozFlushType, int) 	mozilla/layout/base/nsPresShell.cpp:4418
12 	PresShell::FlushPendingNotifications(mozFlushType) 	mozilla/layout/base/nsPresShell.cpp:4385
13 	nsGfxScrollFrameInner::AsyncScrollPortEvent::Run() 	mozilla/layout/generic/nsGfxScrollFrame.cpp:1878
14 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490
15 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
16 	nsThread::Shutdown() 	mozilla/xpcom/threads/nsThread.cpp:445
17 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
18 	nsProxyObjectCallInfo::Run() 	mozilla/xpcom/proxy/src/nsProxyEvent.cpp:181
19 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490

Comment 1

[Martijn Wargers (dead)]

Ok, it doesn't seem to crash online, you have to download the testcase, by using right-click "Save Link Target As.." and then open it locally.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Pertinent parts of the stack:

#9  0xb67a8757 in PresShell::RecreateFramesFor (this=0x8a74760, aContent=0x8a956f0)
    at ../../../mozilla/layout/base/nsPresShell.cpp:3313
#10 0xb6a55264 in nsObjectLoadingContent::EnsureInstantiation (this=0x8a9570c, 
    aInstance=0xbfffd720)
    at ../../../../mozilla/content/base/src/nsObjectLoadingContent.cpp:654
#11 0xb6ccafa1 in nsHTMLPluginObjElementSH::GetPluginInstance (this=0x8ad2d70, 
    wrapper=0x8ad3038, _result=0xbfffd720)
    at ../../../../mozilla/dom/src/base/nsDOMClassInfo.cpp:8511
#12 0xb6ccb0fe in nsHTMLPluginObjElementSH::PostCreate (this=0x8ad2d70, 
    wrapper=0x8ad3038, cx=0x8986588, obj=0x8a923a0)
    at ../../../../mozilla/dom/src/base/nsDOMClassInfo.cpp:8551
#13 0xb71b1ae3 in XPCWrappedNative::GetNewOrUsed (ccx=@0xbfffd930, Object=0x8a956f0, 
    Scope=0x89b0aa0, Interface=0x81389e0, isGlobal=0, resultWrapper=0xbfffd8cc)
    at ../../../../../mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:522
...
#16 0xb6c1228d in nsXBLProtoImpl::InitTargetObjects (this=0x8a98bb0, aBinding=0x8ab5790, 
    aContext=0x898b970, aBoundElement=0x8a956f0, aScriptObjectHolder=0xbfffdac0, 
    aTargetClassObject=0xbfffdabc)
    at ../../../../mozilla/content/xbl/src/nsXBLProtoImpl.cpp:129
...
#20 0xb6c1bbc8 in nsXBLService::LoadBindings (this=0x84dd658, aContent=0x8a956f0, 
    aURL=0x8a7a340, aOriginPrincipal=0x855d2b8, aAugmentFlag=0, aBinding=0xbfffddb0, 
    aResolveStyle=0xbfffdda8) at ../../../../mozilla/content/xbl/src/nsXBLService.cpp:590
#21 0xb6743b9c in nsCSSFrameConstructor::ConstructFrameInternal (this=0x8a75ad8, 
    aState=@0xbfffe240, aContent=0x8a956f0, aParentFrame=0x8ad0544, aTag=0x809adc0, 
    aNameSpaceID=0, aStyleContext=0x8ad130c, aFrameItems=@0xbfffdfa8, aXBLBaseTag=0)
    at ../../../mozilla/layout/base/nsCSSFrameConstructor.cpp:7532

So basically more or less exactly the situation in bug 394970.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Fixed by patch in bug 345711

Comment 4

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007102605 Minefield/3.0a9pre

Comment 5

[Martijn Wargers (dead)]

Oops, I verified the bug with a build that didn't contain the fix for bug 345711 yet.
I guess this was already worksforme before that, then.