Closed Bug 287124 Opened 20 years ago Closed 19 years ago

Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ][@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(4 keywords)

Crash Data

Attachments

(2 files)

See upcoming testcase. When hovering a couple of times over the div, you should not get a crash. It seems a regression, it does not crash with: 2005-02-22 07:27am It does crash with: 2005-02-23 07:24am http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-22+05%3A00%3A00&maxdate=2005-02-23+08%3A00%3A00&cvsroot=%2Fcvsroot
Attached file Flash file for testcase (deleted) —
Attached file Testcase (deleted) —
Talkback ID: TB4507303Y 0x00000000 nsLineLayout::ReflowFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp, line 1144] nsInlineFrame::ReflowInlineFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp, line 712] nsInlineFrame::ReflowFrames [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp, line 530] nsInlineFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp, line 444] nsLineLayout::ReflowFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp, line 999] nsBlockFrame::ReflowInlineFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 4115] nsBlockFrame::DoReflowInlineFrames [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3805] nsBlockFrame::ReflowInlineFrames [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3694] nsBlockFrame::ReflowLine [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2729] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2240] nsBlockFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 833] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 547] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3423] nsBlockFrame::ReflowLine [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2610] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2240] nsBlockFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 833] nsContainerFrame::ReflowChild [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 954] CanvasFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 522] nsFrame::BoxReflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp, line 5361] nsFrame::DoLayout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp, line 5103] nsIFrame::Layout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 802] nsIFrame::Layout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 802] nsContainerFrame::ReflowChild [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 954] ViewportFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 240] IncrementalReflow::Dispatch [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 907] PresShell::ProcessReflowCommands [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6435] PresShell::WillPaint [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6193] PL_HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c, line 699] SHELL32.dll + 0x520c24 (0x778b0c24)
Summary: Crash when div:hover {display:none} with inside iframe with flash embed → Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ]
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050321 Crash Occurs w/this build also. Talkback ID: TB4500717W
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050322 1. I don´t have flash installed 2. saved testcase, removed link to flash, removed link to macromedia, removed parameters, so only <Object> and <embed> were seen, Then tested locally to produce first talkback below. Second Talkback produced with attached testcase loaded from here, both TBs are identical for 26 lines, differ only slightly in the topmost line, as one was including the macromedia URL, the other one no URLs at all. http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4531133Z http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4531202H
TB4500717W: 0x00000000 nsCSSFrameConstructor::CantRenderReplacedElement [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10853] nsFrameManager::HandlePLEvent [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsFrameManager.cpp, line 873] SETUPAPI.DLL + 0x30c24 (0x778b0c24)
Summary: Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ] → Crash when div:hover {display:none} with inside iframe with flash embed [@ 0x00000000 - nsLineLayout::ReflowFrame ][@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]
I get a crash (eventually) because somehow a presshell is destroyed while in the middle of reflow... I don't see anything in the range listed in comment 0 that seems related, though. :(
Flags: blocking1.8b2?
Flags: blocking-aviary1.1?
Keywords: helpwanted
jay is this showing up in top crash data?
I definitely see a few crashes with that stack, but it doesn't appear to be a topcrash. Still, I was able to reproduce this, so we should probably get some eyes on it.
For the record, this is not a problem on the Aviary branch. No crash with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050406 Firefox/1.0.3
Talkback is broken with recent nightlies, so as soon as we get that fixed, I'll post a recent incident here.
My crash with today's build looks about the same as comment #3, just updated line nos.: Incident ID: 4947989 Stack Signature 0x00000000 3f90a6aa Email Address jay@mozilla.org Product ID FirefoxTrunk Build ID 2005040813 Trigger Time 2005-04-08 15:21:58.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module URL visited https://bugzilla.mozilla.org/show_bug.cgi?id=287124 User Comments hovering over iframe border (test case in https://bugzilla.mozilla.org/show_bug.cgi?id=287124) Since Last Crash 58 sec Total Uptime 58 sec Trigger Reason Access violation Source File, Line No. N/A Stack Trace 0x00000000 nsLineLayout::ReflowFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp, line 1148] nsInlineFrame::ReflowInlineFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp, line 712] nsInlineFrame::ReflowFrames [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp, line 530] nsInlineFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp, line 444] nsLineLayout::ReflowFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp, line 999] nsBlockFrame::ReflowInlineFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 4178] nsBlockFrame::DoReflowInlineFrames [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3831] nsBlockFrame::ReflowInlineFrames [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3714] nsBlockFrame::ReflowLine [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2701] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2251] nsBlockFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 875] nsBlockReflowContext::ReflowBlock [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp, line 571] nsBlockFrame::ReflowBlockFrame [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 3431] nsBlockFrame::ReflowLine [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2582] nsBlockFrame::ReflowDirtyLines [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 2251] nsBlockFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 875] nsContainerFrame::ReflowChild [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 908] CanvasFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 522] nsFrame::BoxReflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp, line 5391] nsFrame::DoLayout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp, line 5133] nsIFrame::Layout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 802] nsGfxScrollFrameInner::Layout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1937] nsXULScrollFrame::DoLayout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 1010] nsIFrame::Layout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 802] nsXULScrollFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp, line 958] nsContainerFrame::ReflowChild [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 908] ViewportFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 240] IncrementalReflow::Dispatch [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 908] PresShell::ProcessReflowCommands [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6648] PresShell::WillPaint [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp, line 6406] PL_HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c, line 699] 0x778b0c24 nsPrefetchService::QueryInterface [c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/uriloader/prefetch/nsPrefetchService.cpp, line 418] 0xc25dffeb
Flags: blocking1.8b3?
Flags: blocking1.8b2?
Flags: blocking1.8b2-
wfm winxp seamonkey 2005060306 with flash
Flags: blocking1.8b3? → blocking1.8b3-
transferring nomination to 1.8b4. If we don't get it there, we don't get it for 1.1
Flags: blocking-aviary1.1? → blocking1.8b4?
Flags: blocking1.8b4? → blocking1.8b4-
This is worth retesting now that bug 1156 is fixed, since CantRenderReplacedElement is now gone.
Depends on: 1156
To be honest, I think this is already fixed somehow. I can't get it to crash with the 2005-09-20 trunk build (although, I know it was a bit difficult to crash). Marking WFM?
wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050921 SeaMonkey/1.1a retested with testcase from URL and local testcases I made in comment 5 with and without flash installed, no crash.
WFM seems perfectly fine if it is. ;)
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ 0x00000000 - nsLineLayout::ReflowFrame ] [@ 0x00000000 - nsCSSFrameConstructor::CantRenderReplacedElement ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: