470582 - Crash [@ nsDocShell::SetVisibility] with toggling display iframe, binding removing window and foreignObject

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Martijn Wargers (dead)]

Attachment: zipped up testcase

See zipped up testcase, to reproduce:
- Unzip zipped up testcase, then open up the file named 'parentframe.htm'.

This normally crashes within 3 seconds for me.

It also crashes Firefox 3, so marking security sensitive for now.
It doesn't crash Firefox 2, I can look for a regression range, if wanted.

http://crash-stats.mozilla.com/report/index/6a07bfa8-d2cc-490c-9507-b81052081220?p=1
0  	xul.dll  	xul.dll@0x3138a8  	
1 	xul.dll 	nsDocShell::SetVisibility 	docshell/base/nsDocShell.cpp:4022
2 	xul.dll 	nsSubDocumentFrame::ShowDocShell 	layout/generic/nsFrameFrame.cpp:972
3 	xul.dll 	nsIFrame::GetView 	layout/generic/nsFrame.cpp:3461
4 	xul.dll 	nsSubDocumentFrame::ShowViewer 	layout/generic/nsFrameFrame.cpp:327
5 	xul.dll 	nsSubDocumentFrame::Init 	layout/generic/nsFrameFrame.cpp:312

Perhaps the breakpad stack indicates this might be related to the  	nsSubDocumentFrame::ShowDocShell() crash that is currently nr. 1 in the topcrasher list for Firefox 3.1b3pre?
http://crash-stats.mozilla.com/topcrasher/byversion/Firefox/3.1b3pre

Comment 1

[Daniel Holbert [:dholbert]]

I can reproduce this crash on Linux:
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20090112 Minefield/3.2a1pre
http://crash-stats.mozilla.com/report/index/b11c8077-9645-45e3-8254-30d862090112?p=1

Comment 2

[Jesse Ruderman]

No crashing for me on trunk.  Martijn, are you still seeing this?

Comment 3

[Brandon Sterne (:bsterne)]

This doesn't crash 3.0.15 or trunk for me.  Martijn, can you still reproduce this?

Comment 4

[Martijn Wargers (dead)]

Might very well be fixed now.