835056 - Crash in nsFrameConstructorState::ProcessFrameInsertions in Firefox 21

Status: RESOLVED DUPLICATE of bug 830192

(Core :: Layout, defect)

Description

[Loic]

Attachment: Testcase

STR: Open the testcase attached to the bug.
Result: Firefox 21 crashes immediately.

Regression range:
m-c
good=2012-01-12
bad=2012-01-13
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1761f4a9081c&tochange=23eb44a5636b

Suspected bug:
Robert O'Callahan — Bug 827577. Be a lot more careful about saving and restoring frame constructor state for fixed-pos descendants of CSS-transformed elements. r=bzbarsky

CR: https://crash-stats.mozilla.com/report/index/bp-4fab1998-ecd9-4074-8fc1-564af2130126

Signature 	nsFrameConstructorState::ProcessFrameInsertions(nsAbsoluteItems&, mozilla::layout::FrameChildListID) 

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsFrameConstructorState::ProcessFrameInsertions 	layout/base/nsCSSFrameConstructor.cpp:1266
1 	xul.dll 	nsFrameConstructorState::~nsFrameConstructorState 	layout/base/nsCSSFrameConstructor.cpp:997
2 	xul.dll 	nsCSSFrameConstructor::ContentAppended 	layout/base/nsCSSFrameConstructor.cpp:6796
3 	xul.dll 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6386
4 	xul.dll 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6396
5 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:3867
6 	xul.dll 	nsRefreshDriver::Tick 	layout/base/nsRefreshDriver.cpp:898
7 	xul.dll 	mozilla::RefreshDriverTimer::Tick 	layout/base/nsRefreshDriver.cpp:156
8 	xul.dll 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:482
9 	winmm.dll 	timeGetTime 	
10 	xul.dll 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:565
11 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
12 	xul.dll 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:238
13 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
14 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:208
15 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:182
16 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
17 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:154
18 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:288
19 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3823
20 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3890
21 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4093
22 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp:185
23 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105
24 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
25 	kernel32.dll 	BaseThreadInitThunk 	
26 	ntdll.dll 	__RtlUserThreadStart 	
27 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Mats Palmgren (inactive)]

WFM, mozilla-inbound build.  This was fixed by bug 830192 (not yet in -central).

Comment 2

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/40860caf45b5

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/40860caf45b5