Closed Bug 666751 Opened 9 years ago Closed 9 years ago

Crashing on mail.yandex.ru/lenta (RSS reader)

Categories

(Core :: Layout: Block and Inline, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla7

People

(Reporter: mdykun, Assigned: mats)

References

()

Details

(4 keywords)

Crash Data

Attachments

(4 files, 1 obsolete file)

User-Agent:       Mozilla/5.0 (Windows NT 6.1; rv:7.0a1) Gecko/20110623 Firefox/7.0a1
Build Identifier: Mozilla/5.0 (Windows NT 6.1; rv:7.0a1) Gecko/20110623 Firefox/7.0a1

2011/06/23 crashes on 20110623 http://mail.yandex.ru/lenta

Reports:
https://crash-stats.mozilla.com/report/index/bp-85abffa9-1b77-4dcd-b6a5-d6a352110623
https://crash-stats.mozilla.com/report/index/bp-4fea2d00-bcf1-4917-a88c-281dc2110623
https://crash-stats.mozilla.com/report/index/bp-862184bb-61c9-41ef-9124-1d3f52110623

On yesterday's build no crashes

Reproducible: Always

Steps to Reproduce:
1. Go to http://mail.yandex.ru/lenta (need an yandex account and couple of 
rss feeds there)
2. Crash


Actual Results:  
Browser crashes

Expected Results:  
No crashes
0 	xul.dll 	nsLayoutUtils::GetCrossDocParentFrame 	layout/base/nsLayoutUtils.cpp:475
1 	xul.dll 	mozilla::css::IsFrameDescendantOfAny 	layout/generic/TextOverflow.cpp:184
2 	xul.dll 	mozilla::css::TextOverflow::PruneDisplayListContents 	layout/generic/TextOverflow.cpp:516
3 	xul.dll 	mozilla::css::TextOverflow::ProcessLine 	layout/generic/TextOverflow.cpp:502
4 	xul.dll 	DisplayLine
Crash Signature: [@ nsLayoutUtils::GetCrossDocParentFrame(nsIFrame const*, nsPoint*) ]
Version: unspecified → Trunk
Blocks: 312156
Component: General → Layout: Block and Inline
Keywords: crash, crashreportid
Product: Firefox → Core
QA Contact: general → layout.block-and-inline
Assignee: nobody → matspal
Attached patch fixSplinter Review
I'm pretty sure this will fix it.

Still, I'd really like to have a look at frame tree / display items
when this crash occurs.
Attachment #541534 - Flags: review?(roc)
Attached file testcase (obsolete) —
It's not completely minimized yet, working on it.
Attached file testcase
This is more or less minimized.
Attachment #541535 - Attachment is obsolete: true
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: testcase
Thanks Martijn!  I can reproduce the crash, investigating...
Attached file Frame dump
It's a display item for a fixed pos. frame.  Hmm, I didn't expect that there,
I thought those would end up on their containing block's display lists.
Oh well, the attached null-check should fix it.
Attached patch crash testsSplinter Review
Attachment #541566 - Flags: review?(roc)
OS: Windows 7 → All
Hardware: x86 → All
Comment on attachment 541534 [details] [diff] [review]
fix

Review of attachment 541534 [details] [diff] [review]:
-----------------------------------------------------------------
Attachment #541534 - Flags: review?(roc) → review+
Comment on attachment 541566 [details] [diff] [review]
crash tests

Review of attachment 541566 [details] [diff] [review]:
-----------------------------------------------------------------
Attachment #541566 - Flags: review?(roc) → review+
Please land it!
(In reply to comment #10)
> Please land it!

Hey, no need to be rude!  FYI, comments like that *never* helps.
Implying that he is rude...
Implying that you not spam this bug (like me now)...
http://hg.mozilla.org/mozilla-central/rev/0e4fb0226589
http://hg.mozilla.org/mozilla-central/rev/4f032c2cc14e
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla7
Adding Mac signature so it gets picked up in crash stats.
Crash Signature: [@ nsLayoutUtils::GetCrossDocParentFrame(nsIFrame const*, nsPoint*) ] → [@ nsLayoutUtils::GetCrossDocParentFrame(nsIFrame const*, nsPoint*) ] [@ nsLayoutUtils::GetCrossDocParentFrame ]
You need to log in before you can comment on or make changes to this bug.