Closed Bug 139198 Opened 22 years ago Closed 22 years ago

ASSERTION: no containing block: 'nsnull != cbrs' preceeds crash

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Platform:
x86
FreeBSD
Type:
defect

Tracking

()

Status:
VERIFIED WORKSFORME

People

(Reporter: timeless, Assigned: karnaze)

References

(
URL
)

Details

(Keywords: assertion, crash) 

cvs trunk xlib freebsd4.4 build from last week
on startup, some time after WEBSHELL+ = 2

Note: verifyreflow is disabled
Note: styleverifytree is disabled
warning: property switchskins already exists
warning: property switchskinstitle already exists
Note: frameverifytree is disabled
###!!! ASSERTION: no containing block: 'nsnull != cbrs', file /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp, line 1653
###!!! Break: at file /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp, line 1653
write me, dammit!

Program received signal SIGSEGV, Segmentation fault.
0x29a15e06 in nsHTMLReflowState::ComputeContainingBlockRectangle (this=0xbfbfe664, aPresContext=0x832a000, aContainingBlockRS=0x0,
    aContainingBlockWidth=@0xbfbfe5ac, aContainingBlockHeight=@0xbfbfe5b0) at /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp:1495
1495      aContainingBlockWidth = aContainingBlockRS->mComputedWidth;
Current language:  auto; currently c++
(gdb) l
1490                                                       nscoord&                 aContainingBlockWidth,
1491                                                       nscoord&                 aContainingBlockHeight)
1492    {
1493      // Unless the element is absolutely positioned, the containing block is
1494      // formed by the content edge of the nearest block-level ancestor
1495      aContainingBlockWidth = aContainingBlockRS->mComputedWidth;
1496      aContainingBlockHeight = aContainingBlockRS->mComputedHeight;
1497
1498      if (NS_FRAME_GET_TYPE(mFrameType) == NS_CSS_FRAME_TYPE_ABSOLUTE) {
1499        // See if the ancestor is block-level or inline-level
(gdb) p aContainingBlockRS
$1 = (nsHTMLReflowState *) 0x0
(gdb) up
#1  0x29a16456 in nsHTMLReflowState::InitConstraints (this=0xbfbfe664, aPresContext=0x832a000, aContainingBlockWidth=-1, aContainingBlockHeight=-1,
    aBorder=0x0, aPadding=0x0) at /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp:1659
1659                                          aContainingBlockHeight);
(gdb) l 1650
1645        mComputedBorderPadding.SizeTo(0, 0, 0, 0);
1646        mComputedOffsets.SizeTo(0, 0, 0, 0);
1647        mComputedMinWidth = mComputedMinHeight = 0;
1648        mComputedMaxWidth = mComputedMaxHeight = NS_UNCONSTRAINEDSIZE;
1649      } else {
1650        // Get the containing block reflow state
1651        const nsHTMLReflowState* cbrs =
1652          GetContainingBlockReflowState(parentReflowState);
1653        NS_ASSERTION(nsnull != cbrs, "no containing block");
1654
(gdb) l
1655        // If we weren't given a containing block width and height, then
1656        // compute one
1657        if (aContainingBlockWidth == -1) {
1658          ComputeContainingBlockRectangle(aPresContext, cbrs, aContainingBlockWidth,
1659                                          aContainingBlockHeight);
1660        }
1661
1662        // See if the element is relatively positioned
1663        if (NS_STYLE_POSITION_RELATIVE == mStyleDisplay->mPosition) {
1664          ComputeRelativeOffsets(cbrs, aContainingBlockWidth, aContainingBlockHeight);

The assertion knows we'll crash, so I think I'm going to provide the patch to 
avoid the crash.
(gdb) where
#0  0x29a15e06 in nsHTMLReflowState::ComputeContainingBlockRectangle (this=0xbfbfe664, aPresContext=0x832a000, aContainingBlockRS=0x0,
    aContainingBlockWidth=@0xbfbfe5ac, aContainingBlockHeight=@0xbfbfe5b0) at /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp:1495
#1  0x29a16456 in nsHTMLReflowState::InitConstraints (this=0xbfbfe664, aPresContext=0x832a000, aContainingBlockWidth=-1, aContainingBlockHeight=-1,
    aBorder=0x0, aPadding=0x0) at /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp:1659
#2  0x29a1317d in nsHTMLReflowState::Init (this=0xbfbfe664, aPresContext=0x832a000, aContainingBlockWidth=-1, aContainingBlockHeight=-1, aBorder=0x0,
    aPadding=0x0) at /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp:275
#3  0x29a12ed8 in nsHTMLReflowState::nsHTMLReflowState (this=0xbfbfe664, aPresContext=0x832a000, aParentReflowState=@0xbfbfe99c, aFrame=0x832e2f8,
    aAvailableSpace=@0xbfbfe764) at /home/timeless/mozilla/layout/html/base/src/nsHTMLReflowState.cpp:214
#4  0x29a83bed in ViewportFrame::Reflow (this=0x832e0d0, aPresContext=0x832a000, aDesiredSize=@0xbfbfea58, aReflowState=@0xbfbfe99c, aStatus=@0xbfbfeaa4)
    at /home/timeless/mozilla/layout/html/base/src/nsViewportFrame.cpp:582
#5  0x29a4ee0a in PresShell::InitialReflow (this=0x832a400, aWidth=1400, aHeight=1400) at /home/timeless/mozilla/layout/html/base/src/nsPresShell.cpp:2652
#6  0x2922f6f5 in HTMLContentSink::StartLayout (this=0x80e2e00) at /home/timeless/mozilla/content/html/document/src/nsHTMLContentSink.cpp:3996
#7  0x2922ce2b in HTMLContentSink::OpenBody (this=0x80e2e00, aNode=@0x8329840) at /home/timeless/mozilla/content/html/document/src/nsHTMLContentSink.cpp:3226
#8  0x28c7e49e in CNavDTD::OpenBody (this=0x82cd900, aNode=0x8329840) at /home/timeless/mozilla/htmlparser/src/CNavDTD.cpp:3147
#9  0x28c7eb8d in CNavDTD::OpenContainer (this=0x82cd900, aNode=0x8329840, aTag=eHTMLTag_body, aClosedByStartTag=1, aStyleStack=0x0)
    at /home/timeless/mozilla/htmlparser/src/CNavDTD.cpp:3392
#10 0x28c79b9a in CNavDTD::HandleDefaultStartToken (this=0x82cd900, aToken=0x82b41a0, aChildTag=eHTMLTag_body, aNode=0x8329840)
    at /home/timeless/mozilla/htmlparser/src/CNavDTD.cpp:1321
#11 0x28c7af75 in CNavDTD::HandleStartToken (this=0x82cd900, aToken=0x82b41a0) at /home/timeless/mozilla/htmlparser/src/CNavDTD.cpp:1731
#12 0x28c78924 in CNavDTD::HandleToken (this=0x82cd900, aToken=0x82b41a0, aParser=0x82b3300) at /home/timeless/mozilla/htmlparser/src/CNavDTD.cpp:893
#13 0x28c77508 in CNavDTD::BuildModel (this=0x82cd900, aParser=0x82b3300, aTokenizer=0x8228080, anObserver=0x0, aSink=0x80e2e00)
    at /home/timeless/mozilla/htmlparser/src/CNavDTD.cpp:511
#14 0x28c8e138 in nsParser::BuildModel (this=0x82b3300) at /home/timeless/mozilla/htmlparser/src/nsParser.cpp:1864
#15 0x28c8dd2e in nsParser::ResumeParse (this=0x82b3300, allowIteration=1, aIsFinalChunk=0, aCanInterrupt=1)
    at /home/timeless/mozilla/htmlparser/src/nsParser.cpp:1731
#16 0x28c8fb4c in nsParser::OnDataAvailable (this=0x82b3300, request=0x8225c00, aContext=0x0, pIStream=0x8225f90, sourceOffset=0, aLength=117)
    at /home/timeless/mozilla/htmlparser/src/nsParser.cpp:2365
#17 0x28d2f89d in nsDocumentOpenInfo::OnDataAvailable (this=0x8226860, request=0x8225c00, aCtxt=0x0, inStr=0x8225f90, sourceOffset=0, count=117)
    at /home/timeless/mozilla/uriloader/base/nsURILoader.cpp:242
#18 0x28768d59 in nsStreamIOChannel::OnDataAvailable (this=0x8225c00, request=0x8225c84, context=0x0, aIStream=0x8225f90, aSourceOffset=0, aLength=117)
    at /home/timeless/mozilla/netwerk/base/src/nsInputStreamChannel.cpp:507
#19 0x2878fd25 in nsOnDataAvailableEvent::HandleEvent (this=0x81115c0) at /home/timeless/mozilla/netwerk/base/src/nsStreamListenerProxy.cpp:192
#20 0x28776df4 in nsARequestObserverEvent::HandlePLEvent (plev=0x81115c0) at /home/timeless/mozilla/netwerk/base/src/nsRequestObserverProxy.cpp:115
#21 0x2829ac35 in PL_HandleEvent (self=0x81115c0) at /home/timeless/mozilla/xpcom/threads/plevent.c:596
#22 0x2829aa1c in PL_ProcessPendingEvents (self=0x8144980) at /home/timeless/mozilla/xpcom/threads/plevent.c:526
#23 0x2829cf18 in nsEventQueueImpl::ProcessPendingEvents (this=0x8144940) at /home/timeless/mozilla/xpcom/threads/nsEventQueue.cpp:388
#24 0x2892ad1c in HandleQueueXtProc (ptr=0x8144940, source_fd=0x80eb1d4, id=0xbfbff4c8) at /home/timeless/mozilla/widget/src/xlib/nsAppShell.cpp:342
#25 0x2899519c in DoOtherSources () from /usr/X11R6/lib/libXt.so.6
#26 0x2899547d in XtAppNextEvent () from /usr/X11R6/lib/libXt.so.6
#27 0x2892addd in nsAppShell::Run (this=0x80ce400) at /home/timeless/mozilla/widget/src/xlib/nsAppShell.cpp:361
#28 0x288c5ce1 in nsAppShellService::Run (this=0x809d500) at /home/timeless/mozilla/xpfe/appshell/src/nsAppShellService.cpp:308
#29 0x08055e2b in main1 (argc=4, argv=0xbfbff7e0, nativeApp=0x0) at /home/timeless/mozilla/xpfe/bootstrap/nsAppRunner.cpp:1420
#30 0x08056799 in main (argc=4, argv=0xbfbff7e0) at /home/timeless/mozilla/xpfe/bootstrap/nsAppRunner.cpp:1768
#31 0x0805019d in _start ()

#18 0x28768d59 in nsStreamIOChannel::OnDataAvailable (this=0x8225c00, request=0x8225c84, context=0x0, aIStream=0x8225f90, aSourceOffset=0, aLength=117)
    at /home/timeless/mozilla/netwerk/base/src/nsInputStreamChannel.cpp:507
507                                               aSourceOffset, aLength);
(gdb) p *(nsSimpleURI*) mOriginalURI
$4 = {<nsIURI> = {<nsISupports> = {_vptr$ = 0x2887a000}, <No data fields>}, <nsISerializable> = {<nsISupports> = {_vptr$ = 0x28879fc0}, <No data fields>},
  mRefCnt = 11, _mOwningThread = 0x8080380, fOuter = 0x8223f94, fAggregated = {<nsISupports> = {_vptr$ = 0x2887a120}, <No data fields>},
  mScheme = {<nsAFlatCString> = {<nsASingleFragmentCString> = {<nsACString> = {_vptr$ = 0x2835f900}, <No data fields>}, <No data fields>}, <nsStr> = {{
        mStr = 0x8234ae0 "about", mUStr = 0x8234ae0}, mLength = 5, mCapacityAndFlags = 1073741829}, <No data fields>},
  mPath = {<nsAFlatCString> = {<nsASingleFragmentCString> = {<nsACString> = {_vptr$ = 0x2835f900}, <No data fields>}, <No data fields>}, <nsStr> = {{
        mStr = 0x8234af0 "blank", mUStr = 0x8234af0}, mLength = 5, mCapacityAndFlags = 1073741829}, <No data fields>}}

about:blank. glory.
URL: about:blank
Keywords: assertion, crash
Changing QA Contact
QA Contact: petersen → moied
this crashed because the parentReflowState that was passed to 
GetContainingBlockReflowState had a parentReflowState member that was null, and 
it was itself a containing block.

I don't know why this happened, but it is happening on both my trunk gtk and 
xlib builds.
Status: UNCONFIRMED → NEW
Ever confirmed: true
timeless:  Why is your tree messed up in ways that nobody else's ever manages to be?
about:blank works fine for me. How do I reproduce this?
dbaron: dunno.
hrm, just finished a build of both trees and now they're happy, it's odd, i'm
sure i'd rebuilt a few times ...

is it possible to at least decide what the correct behavior should be in the
case when there is no containing block, so that in the future this problem
doesn't happen?

if not, we can resolve this as wfm.
Severity: critical → minor
Priority: -- → P3
WFM.
Status: NEW → RESOLVED
Closed: 22 years ago
Resolution: --- → WORKSFORME
verified
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.