723659 - crash PresShell::DidDoReflow

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[juan becerra [:juanb]]

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:13.0a1) Gecko/20120202 Firefox/13.0a1

This bug was filed from the Socorro interface and is 
report bp-f212cc1e-cf04-485e-8bc9-86e5c2120202 .
============================================================= 

I clicked on a video link within http://www.wingmancam.com/WingmanCam/Videos.html and the browser crashed immediately. Before that I had clicked on a video link in a different page (autoblog.com) without problems.

I have not been able to reproduce the problem, yet.

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

I just saw this tonight by:

1. Loading http://www.incapsula.com/
2. Clicking on Play Movie
3. Clicking the Play button

Build identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:13.0a1) Gecko/20120202 Firefox/13.0a1

https://crash-stats.mozilla.com/report/index/bp-7a934275-2a7e-4895-89a5-e93742120203

Comment 2

[Scoobidiver (away)]

I can't reproduce it on Windows.
It first appeared in 13.0a1/20120202. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e18c7bc2c28e&tochange=5b0900b3e71c

The first frames of the stack look like:
Frame 	Module 	Signature 	Source
0 	XUL 	PresShell::DidDoReflow 	layout/base/nsPresShell.cpp:3945
1 	XUL 	PresShell::ProcessReflowCommands 	layout/base/nsPresShell.cpp:7775
2 	XUL 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4111
3 	XUL 	nsViewManager::CallWillPaintOnObservers 	view/src/nsViewManager.cpp:1383
4 	XUL 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:777
5 	XUL 	HandleEvent 	view/src/nsView.cpp:158
6 	XUL 	nsChildView::DispatchEvent 	widget/cocoa/nsChildView.mm:1512
7 	XUL 	nsChildView::DispatchWindowEvent 	widget/cocoa/nsChildView.mm:1522
8 	XUL 	-[ChildView viewWillDraw] 	widget/cocoa/nsChildView.mm:2707

More report at:
https://crash-stats.mozilla.com/report/list?signature=PresShell%3A%3ADidDoReflow

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

http://hg.mozilla.org/mozilla-central/rev/07edb8ba21b9 could be a culprit, given that it's plugin-related changes.

Comment 4

[Mats Palmgren (inactive)]

I can reproduce the crash on OSX if I reload the page and repeat the STR in comment 1
a few times.

Comment 5

[Mats Palmgren (inactive)]

Attachment: fix

Try results pending:  https://tbpl.mozilla.org/?tree=Try&rev=f33250b29323

Comment 6

[Mats Palmgren (inactive)]

Looks like the bug has been present since the nsObjectFrame reflow callback
was added in mozilla-2.0:
http://hg.mozilla.org/releases/mozilla-2.0/rev/be4524bc2416

Comment 7

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/76640a2f72b3

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/76640a2f72b3