493197 - Crash [@ nsSubDocumentFrame::Destroy] with video in video and removing window

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect)

Description

[Martijn Wargers (dead)]

Attachment: zipped up testcase

To reproduce:
- Download zipped up testcase, unzip it
- Download video file from http://martijn.martijn.googlepages.com/football.ogg
- Open file named 'parentframe.htm'

It usually crashes for me after 20 seconds or so.

I think this is a regression, in my not updated debug build, it wouldn't crash, after I updated it, it crashed.

http://crash-stats.mozilla.com/report/index/cefa3a79-9f61-42d8-ac05-1400b2090514
0  	xul.dll  	xul.dll@0x3cc73f  	
1 	xul.dll 	xul.dll@0x384996 	
2 	xul.dll 	xul.dll@0x3b426b 	
3 	xul.dll 	nsSubDocumentFrame::Destroy 	layout/generic/nsFrameFrame.cpp:753
4 	xul.dll 	nsBlockFrame::DoRemoveFrame 	layout/generic/nsBlockFrame.cpp:5517
5 	xul.dll 	nsBlockFrame::RemoveFrame 	layout/generic/nsBlockFrame.cpp:5107
6 	xul.dll 	nsCSSFrameConstructor::ContentRemoved 	layout/base/nsCSSFrameConstructor.cpp:7109
7 	xul.dll 	PresShell::ContentRemoved 	layout/base/nsPresShell.cpp:4983
8 	xul.dll 	nsNodeUtils::ContentRemoved 	content/base/src/nsNodeUtils.cpp:168
9 	xul.dll 	nsGenericElement::doRemoveChildAt 	content/base/src/nsGenericElement.cpp:3395
10 	xul.dll 	nsGenericElement::RemoveChildAt 	content/base/src/nsGenericElement.cpp:3325
11 	xul.dll 	nsGenericElement::doRemoveChild 	content/base/src/nsGenericElement.cpp:4002
12 	xul.dll 	nsHTMLDivElement::RemoveChild 	content/base/src/nsGenericElement.cpp:3560
13 	xul.dll 	nsIDOMNode_RemoveChild 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:4183
14 	js3250.dll 	js_Interpret 	js/src/jsinterp.cpp:5118
15 	js3250.dll 	js_Invoke 	js/src/jsinterp.cpp:1375
16 	js3250.dll 	js_InternalInvoke 	js/src/jsinterp.cpp:1428
17 	js3250.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5191
18 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2026
19 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:7780
20 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:8114
21 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:427
22 	nspr4.dll 	_PR_MD_UNLOCK 	nsprpub/pr/src/md/windows/w95cv.c:344
23 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:519
24 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
25 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
26 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:193
27 	nspr4.dll 	PR_GetEnv 	
28 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:110
29 	firefox.exe 	firefox.exe@0x21a7 	
30 	kernel32.dll 	kernel32.dll@0x17076 

Stack from debug build:
>	gklayout.dll!nsCOMPtr<nsIDocument>::assign_assuming_AddRef(nsIDocument * newPtr=0x00000000)  Line 496	C++
 	gklayout.dll!nsCOMPtr<nsIDocument>::assign_with_AddRef(nsISupports * rawPtr=0x00000000)  Line 1182	C++
 	gklayout.dll!nsCOMPtr<nsIDocument>::operator=(nsIDocument * rhs=0x00000000)  Line 641	C++
 	gklayout.dll!DocumentViewerImpl::Destroy()  Line 1507	C++
 	gklayout.dll!DocumentViewerImpl::Hide()  Line 1946	C++
 	docshell.dll!nsDocShell::SetVisibility(int aVisibility=0)  Line 4531	C++
 	gklayout.dll!nsSubDocumentFrame::HideViewer()  Line 791	C++
 	gklayout.dll!nsSubDocumentFrame::Destroy()  Line 755	C++
 	gklayout.dll!nsBlockFrame::DoRemoveFrame(nsIFrame * aDeletedFrame=0x0c536004, unsigned int aFlags=2)  Line 5510	C++
 	gklayout.dll!nsBlockFrame::RemoveFrame(nsIAtom * aListName=0x00000000, nsIFrame * aOldFrame=0x0c536004)  Line 5098 + 0xe bytes	C++
 	gklayout.dll!nsFrameManager::RemoveFrame(nsIFrame * aParentFrame=0x0c535ebc, nsIAtom * aListName=0x00000000, nsIFrame * aOldFrame=0x0c536004)  Line 717 + 0x16 bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::ContentRemoved(nsIContent * aContainer=0x0c529e60, nsIContent * aChild=0x0c269f70, int aIndexInContainer=4, int * aDidReconstruct=0x0012ea48)  Line 7120 + 0x12 bytes	C++
 	gklayout.dll!PresShell::ContentRemoved(nsIDocument * aDocument=0x0c1e2a60, nsIContent * aContainer=0x0c529e60, nsIContent * aChild=0x0c269f70, int aIndexInContainer=4)  Line 4992	C++
 	gklayout.dll!nsNodeUtils::ContentRemoved(nsINode * aContainer=0x0c529e60, nsIContent * aChild=0x0c269f70, int aIndexInContainer=4)  Line 168 + 0xe6 bytes	C++
 	gklayout.dll!nsGenericElement::doRemoveChildAt(unsigned int aIndex=4, int aNotify=1, nsIContent * aKid=0x0c269f70, nsIContent * aParent=0x0c529e60, nsIDocument * aDocument=0x0c1e2a60, nsAttrAndChildArray & aChildArray={...})  Line 3395 + 0x11 bytes	C++
 	gklayout.dll!nsGenericElement::RemoveChildAt(unsigned int aIndex=4, int aNotify=1)  Line 3325 + 0x2a bytes	C++
 	gklayout.dll!nsGenericElement::doRemoveChild(nsIDOMNode * aOldChild=0x0c269f9c, nsIContent * aParent=0x0c529e60, nsIDocument * aDocument=0x0c1e2a60, nsIDOMNode * * aReturn=0x0012ebdc)  Line 4002 + 0x13 bytes	C++
etc...

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Not going to block the release on this, would still take a patch.

Comment 2

[Matthew Gregan [:kinetik]]

Hmm, this doesn't crash on OS X for me after running the testcase for about 20 minutes.