448543 - Crash [@ nsVideoFrame::Thaw] with video element and table display types

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build on load.

http://crash-stats.mozilla.com/report/index/ff3fc7a8-5e54-11dd-9e43-001cc45a2c28?p=1
0  	xul.dll  	nsVideoFrame::Thaw  	 layout/generic/nsVideoFrame.cpp:344
1 	xul.dll 	nsDisplayList::Paint 	layout/base/nsDisplayList.cpp:297
2 	xul.dll 	nsStyleBorder::nsStyleBorder 	layout/style/nsStyleStruct.cpp:367
3 	xul.dll 	nsTableFrame::PaintTableBorderBackground 	layout/tables/nsTableFrame.cpp:1466
4 	xul.dll 	nsDisplayTableBorderBackground::Paint 	layout/tables/nsTableFrame.cpp:1315
5 	xul.dll 	nsDisplayList::Paint 	layout/base/nsDisplayList.cpp:297
6 	xul.dll 	nsDisplayClip::Paint 	layout/base/nsDisplayList.cpp:898
7 	xul.dll 	nsDisplayList::Paint 	layout/base/nsDisplayList.cpp:297
8 	xul.dll 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:993
9 	xul.dll 	PresShell::Paint 	layout/base/nsPresShell.cpp:5427
10 	xul.dll 	nsViewManager::RenderViews 	view/src/nsViewManager.cpp:616
11 	xul.dll 	nsViewManager::Refresh 	view/src/nsViewManager.cpp:502
12 	xul.dll 	xul.dll@0x31e7bf 	
etc..

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase2

http://crash-stats.mozilla.com/report/index/eefa8f78-688f-11dd-bc72-0013211cbf8a?p=1
0  	 	@0x7d5960  	
1 	xul.dll 	nsTableRowGroupFrame::CalculateRowHeights 	layout/tables/nsTableRowGroupFrame.cpp:606
2 	xul.dll 	nsTableRowGroupFrame::ReflowChildren 	layout/tables/nsTableRowGroupFrame.cpp:523
3 	xul.dll 	nsTableRowGroupFrame::Reflow 	layout/tables/nsTableRowGroupFrame.cpp:1360
4 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:771
5 	xul.dll 	nsTableFrame::ReflowChildren 	layout/tables/nsTableFrame.cpp:2992
6 	xul.dll 	nsTableFrame::ReflowTable 	layout/tables/nsTableFrame.cpp:2027
7 	xul.dll 	nsTableFrame::Reflow 	layout/tables/nsTableFrame.cpp:1926
8 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:771
9 	xul.dll 	nsTableOuterFrame::OuterDoReflowChild 	layout/tables/nsTableOuterFrame.cpp:1122
10 	xul.dll 	nsTableOuterFrame::Reflow 	layout/tables/nsTableOuterFrame.cpp:1264
11 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:310
12 	xul.dll 	nsBlockFrame::ReflowBlockFrame 	layout/generic/nsBlockFrame.cpp:2996
13 	xul.dll 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2268
14 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1904
15 	xul.dll 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:962
16 	xul.dll 	nsBlockReflowContext::ReflowBlock 	layout/generic/nsBlockReflowContext.cpp:310
17 	xul.dll 	nsBlockFrame::ReflowBlockFrame 	layout/generic/nsBlockFrame.cpp:2996
18 	xul.dll 	nsBlockFrame::ReflowLine 	layout/generic/nsBlockFrame.cpp:2268
19 	xul.dll 	nsBlockFrame::ReflowDirtyLines 	layout/generic/nsBlockFrame.cpp:1904
20 	xul.dll 	nsBlockFrame::Reflow 	layout/generic/nsBlockFrame.cpp:962
21 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:771
22 	xul.dll 	CanvasFrame::Reflow 	layout/generic/nsHTMLFrame.cpp:567
23 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:771
24 	xul.dll 	nsHTMLScrollFrame::ReflowScrolledFrame 	layout/generic/nsGfxScrollFrame.cpp:517
25 	xul.dll 	nsHTMLScrollFrame::ReflowContents 	layout/generic/nsGfxScrollFrame.cpp:611
26 	xul.dll 	nsHTMLScrollFrame::Reflow 	layout/generic/nsGfxScrollFrame.cpp:812
27 	xul.dll 	nsContainerFrame::ReflowChild 	layout/generic/nsContainerFrame.cpp:771
28 	xul.dll 	ViewportFrame::Reflow 	layout/generic/nsViewportFrame.cpp:286
29 	xul.dll 	PresShell::DoReflow 	layout/base/nsPresShell.cpp:6324
30 	xul.dll 	PresShell::ProcessReflowCommands 	layout/base/nsPresShell.cpp:6430

Show/hide other threads

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase3

Double-clicking right next to the iframe is crashing.

Comment 3

[Bernd]

Boris, <video> is not mentioned in my favorite function IsSpecialContent but it probably should?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yikes.  Yes, that should be in IsSpecialContent, #ifdef MOZ_MEDIA.

Comment 5

[Bernd]

seems that the warnings where not explicit enough in the code, but QA automation does not know mercy.

Comment 6

[Bernd]

Attachment: patch

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 344344 [details] [diff] [review]
patch

r+sr=bzbarsky

Comment 8

[Bernd]

http://hg.mozilla.org/mozilla-central/rev/3e0af2b93a93

Comment 9

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081029 Minefield/3.1b2pre

Comment 10

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ec1c822f8157

Comment 11

[Gregory Szorc [:gps]]

https://hg.mozilla.org/mozilla-central/rev/ec1c822f8157