Closed
Bug 287124
Opened 20 years ago
Closed 19 years ago
Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ][@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: martijn.martijn, Unassigned)
References
Details
(4 keywords)
Crash Data
Attachments
(2 files)
See upcoming testcase.
When hovering a couple of times over the div, you should not get a crash.
It seems a regression, it does not crash with:
2005-02-22 07:27am
It does crash with:
2005-02-23 07:24am
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-22+05%3A00%3A00&maxdate=2005-02-23+08%3A00%3A00&cvsroot=%2Fcvsroot
Reporter | ||
Comment 1•20 years ago
|
||
Reporter | ||
Comment 2•20 years ago
|
||
Reporter | ||
Comment 3•20 years ago
|
||
Talkback ID: TB4507303Y
0x00000000
nsLineLayout::ReflowFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 1144]
nsInlineFrame::ReflowInlineFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 712]
nsInlineFrame::ReflowFrames
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 530]
nsInlineFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 444]
nsLineLayout::ReflowFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 999]
nsBlockFrame::ReflowInlineFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 4115]
nsBlockFrame::DoReflowInlineFrames
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3805]
nsBlockFrame::ReflowInlineFrames
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3694]
nsBlockFrame::ReflowLine
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2729]
nsBlockFrame::ReflowDirtyLines
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2240]
nsBlockFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 833]
nsBlockReflowContext::ReflowBlock
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3423]
nsBlockFrame::ReflowLine
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2610]
nsBlockFrame::ReflowDirtyLines
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2240]
nsBlockFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 833]
nsContainerFrame::ReflowChild
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 954]
CanvasFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 522]
nsFrame::BoxReflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5361]
nsFrame::DoLayout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5103]
nsIFrame::Layout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsIFrame::Layout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsContainerFrame::ReflowChild
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 954]
ViewportFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 240]
IncrementalReflow::Dispatch
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 907]
PresShell::ProcessReflowCommands
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6435]
PresShell::WillPaint
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6193]
PL_HandleEvent
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
SHELL32.dll + 0x520c24 (0x778b0c24)
Updated•20 years ago
|
Summary: Crash when div:hover {display:none} with inside iframe with flash embed → Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ]
Comment 4•20 years ago
|
||
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050321
Crash Occurs w/this build also. Talkback ID: TB4500717W
Comment 5•20 years ago
|
||
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050322
1. I don´t have flash installed
2. saved testcase, removed link to flash, removed link to macromedia, removed
parameters, so only <Object> and <embed> were seen,
Then tested locally to produce first talkback below.
Second Talkback produced with attached testcase loaded from here, both TBs are
identical for 26 lines, differ only slightly in the topmost line, as one was
including the macromedia URL, the other one no URLs at all.
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4531133Z
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4531202H
Comment 6•20 years ago
|
||
TB4500717W:
0x00000000
nsCSSFrameConstructor::CantRenderReplacedElement
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 10853]
nsFrameManager::HandlePLEvent
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsFrameManager.cpp,
line 873]
SETUPAPI.DLL + 0x30c24 (0x778b0c24)
Summary: Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ] → Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ][@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]
Comment 7•20 years ago
|
||
I get a crash (eventually) because somehow a presshell is destroyed while in the
middle of reflow... I don't see anything in the range listed in comment 0 that
seems related, though. :(
Comment 8•20 years ago
|
||
jay is this showing up in top crash data?
Comment 9•20 years ago
|
||
I definitely see a few crashes with that stack, but it doesn't appear to be a
topcrash. Still, I was able to reproduce this, so we should probably get some
eyes on it.
Comment 10•20 years ago
|
||
For the record, this is not a problem on the Aviary branch. No crash with
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050406
Firefox/1.0.3
Comment 11•20 years ago
|
||
Talkback is broken with recent nightlies, so as soon as we get that fixed, I'll
post a recent incident here.
Comment 12•20 years ago
|
||
My crash with today's build looks about the same as comment #3, just updated
line nos.:
Incident ID: 4947989
Stack Signature 0x00000000 3f90a6aa
Email Address jay@mozilla.org
Product ID FirefoxTrunk
Build ID 2005040813
Trigger Time 2005-04-08 15:21:58.0
Platform Win32
Operating System Windows NT 5.1 build 2600
Module
URL visited https://bugzilla.mozilla.org/show_bug.cgi?id=287124
User Comments hovering over iframe border (test case in
https://bugzilla.mozilla.org/show_bug.cgi?id=287124)
Since Last Crash 58 sec
Total Uptime 58 sec
Trigger Reason Access violation
Source File, Line No. N/A
Stack Trace
0x00000000
nsLineLayout::ReflowFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 1148]
nsInlineFrame::ReflowInlineFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 712]
nsInlineFrame::ReflowFrames
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 530]
nsInlineFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 444]
nsLineLayout::ReflowFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 999]
nsBlockFrame::ReflowInlineFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 4178]
nsBlockFrame::DoReflowInlineFrames
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3831]
nsBlockFrame::ReflowInlineFrames
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3714]
nsBlockFrame::ReflowLine
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2701]
nsBlockFrame::ReflowDirtyLines
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 875]
nsBlockReflowContext::ReflowBlock
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 571]
nsBlockFrame::ReflowBlockFrame
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3431]
nsBlockFrame::ReflowLine
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2582]
nsBlockFrame::ReflowDirtyLines
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2251]
nsBlockFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 875]
nsContainerFrame::ReflowChild
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 908]
CanvasFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 522]
nsFrame::BoxReflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5391]
nsFrame::DoLayout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5133]
nsIFrame::Layout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsGfxScrollFrameInner::Layout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1937]
nsXULScrollFrame::DoLayout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1010]
nsIFrame::Layout
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsXULScrollFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 958]
nsContainerFrame::ReflowChild
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 908]
ViewportFrame::Reflow
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 240]
IncrementalReflow::Dispatch
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 908]
PresShell::ProcessReflowCommands
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6648]
PresShell::WillPaint
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6406]
PL_HandleEvent
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
0x778b0c24
nsPrefetchService::QueryInterface
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/prefetch/nsPrefetchService.cpp,
line 418]
0xc25dffeb
Updated•19 years ago
|
Flags: blocking1.8b3?
Flags: blocking1.8b2?
Flags: blocking1.8b2-
Comment 13•19 years ago
|
||
wfm winxp seamonkey 2005060306 with flash
Updated•19 years ago
|
Flags: blocking1.8b3? → blocking1.8b3-
Comment 14•19 years ago
|
||
transferring nomination to 1.8b4. If we don't get it there, we don't get it for 1.1
Flags: blocking-aviary1.1? → blocking1.8b4?
Updated•19 years ago
|
Flags: blocking1.8b4? → blocking1.8b4-
Comment 15•19 years ago
|
||
This is worth retesting now that bug 1156 is fixed, since
CantRenderReplacedElement is now gone.
Depends on: 1156
Reporter | ||
Comment 16•19 years ago
|
||
To be honest, I think this is already fixed somehow.
I can't get it to crash with the 2005-09-20 trunk build (although, I know it was
a bit difficult to crash).
Marking WFM?
Comment 17•19 years ago
|
||
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050921 SeaMonkey/1.1a
retested with testcase from URL and local testcases I made in comment 5 with and
without flash installed, no crash.
Comment 18•19 years ago
|
||
WFM seems perfectly fine if it is. ;)
Reporter | ||
Updated•19 years ago
|
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → WORKSFORME
Assignee | ||
Updated•13 years ago
|
Crash Signature: [@ 0x00000000 - nsLineLayout::ReflowFrame ]
[@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]
You need to log in
before you can comment on or make changes to this bug.
Description
•