Pale Moon crash on Mode.com

[Spam404]

I found an issue affecting mode.com and potentially other sites with a similar element.

To reproduce:
1. Go here - https://www.mode.com/
2. Click on the following button -

3. Pale Moon should have ended abruptly

Extra Info:
OS: Windows 10
Exact Version: 26.3.2 (x86)
Other Browser Results: Chrome and Firefox handle the button fine

[lyceus]

Extra Info:
OS: Windows 10
Exact Version: 26.3.2 (x86)
Other Browser Results: Chrome and Firefox handle the button fine

Moderator note: Confirmed that happens too in Windows 7Pro X64 with Pale Moon 26.3.3, as tested before post approval.

[Nigaikaze]

To reproduce:
1. Go here - https://www.mode.com/
2. Click on the following button -

3. Pale Moon should have ended abruptly

Also verified it segfaults with PM 26.3.3 x64 on Linux Mint 17.3:

Code: Select all

###!!! ABORT: unexpected frame type: file /home/trava90/PaleMoon/pmsrc/layout/base/nsCSSFrameConstructor.cpp, line 8859
###!!! ABORT: unexpected frame type: file /home/trava90/PaleMoon/pmsrc/layout/base/nsCSSFrameConstructor.cpp, line 8859
Segmentation fault

EDIT: However, that button does seem to work properly with the Tycho alpha PM 27.0.0a1 x64 on Win 7.

[satrow]

Appears to work as expected on the public Alpha version of the upcoming PM 27.

[Moonchild]

It's a deliberate runtime abort. I'll see if I can get more details for at least a temporary fix for the CTD.

[Moonchild]

Unfortunately I've been unable to get a stack trace so far, which I need to know where in the layout engine this goes wrong. Unfortunately it's somewhere deep in frame layout logic by the looks of it, which may not be fixable in pm-r without breaking other sites.

If someone can get an actual call stack for this CTD, that would help.