62887 - browser crashes due to invalid markup for a plugin

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[shrirang khanzode]

Plugin :Flash 5.0
Build :trunk 12/14
This is working fine on the branch build 1211.

Steps:
1 Go to the above url
2 Click on "10 Best cars" from the menu on left
3 Observe taht as the page is about to load, 6.0 crashes.

Stack:


 Call Stack:    (Signature = nsHTMLContainerFrame::ReparentFrameViewList 
bcf31081) 
     
   nsHTMLContainerFrame::ReparentFrameViewList 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsHTMLContainerFrame.cpp, line 
366]
     
   MoveChildrenTo 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 434]
     
   nsCSSFrameConstructor::SplitToContainingBlock 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 13160]
     
   nsCSSFrameConstructor::CantRenderReplacedElement 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 10751]
     
   StyleSetImpl::CantRenderReplacedElement 
                                                    
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1248]
     
   FrameManager::HandlePLEvent 
                                                    
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 917]
     
   PL_HandleEvent 
                                                    
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 577]
     
   PL_ProcessPendingEvents 
                                                    
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 513]
     
   _md_EventReceiverProc 
                                                    
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1055]


 Registers:

Comment 1

[Peter Lubczynski]

Attachment: simple testcase

Comment 2

[Peter Lubczynski]

This is not a plugin bug. The page has invalid markup that the parser should
catch. I have attached a simplified testcase. Tested with today's pull on W2K.

Cc:ing buster just in case it's something in frames as the stack trace suggests.
Updating URL, owner, keywords, and summary.

Comment 3

[harishd]

Peter, IMO, the plug-in code should be more robust whether or not the parser 
catches invalid markup. I'll take a look at the parser end for the invalid 
markup but I'd strongly recommend you to make the plug-in code more robust.

Comment 4

[harishd]

Attachment: testcase [ valid markup but still crashes! ]

Comment 5

[harishd]

Giving bug back to [e-mail].

Comment 6

[shrirang khanzode]

well ,the original page does not crash anymore on 20010116 trunk on windows.

Comment 7

[Peter Lubczynski]

Marking FIXED as none of the testcases crash now.

Comment 8

[shrirang khanzode]

yep ,verified fixed (0116)trunk and branch.