378413 - Hang with display: -moz-deck, direction: rtl, fieldset

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (hangs Firefox when loaded)

This testcase makes Firefox (Mac trunk debug) hang, spewing the following assertion the whole time:

###!!! ASSERTION: Bogus availSize.width; should be bigger: '!mContentFrame || GetContentMinWidth(aReflowState.rendContext) <= availSize.width', file /Users/jruderman/trunk/mozilla/layout/forms/nsFieldSetFrame.cpp, line 474

Comment 1

[Boris Zbarsky [:bzbarsky]]

I have no idea what the deal is with the width, offhand, but the hang is due to height growth.  nsStackLayout keeps looping while the kid is growing, and each time it sets a computed height on the fieldset, the fieldset reflows at that height, overflows (because the content frame is height: 100% and the legend takes some space), nsFrame::BoxReflow does:

  aDesiredSize.height = aDesiredSize.mOverflowArea.YMost();

which increases aDesiredSize.height from what it used to be (which was equal to the computed height).

So we do this over and over again forever.

Comment 2

[Jesse Ruderman]

Still hangs on trunk.

Comment 3

[Martijn Wargers (dead)]

The testcase has become worksforme between 2007-11-05 and 2007-11-06:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-11-05+03&maxdate=2007-11-06+09&cvsroot=%2Fcvsroot

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Is there a reason to not close it?

Comment 5

[Martijn Wargers (dead)]

I haven't tested it on mac and I know that Jesse normally reacts quite quickly to comments (and maybe someone is interested in what fixed it).

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Works for me on Mac trunk debug.

Comment 7

[Jesse Ruderman]

Works for me, too.  No crash, no assertion failures.

Comment 8

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).

Comment 9

[Jesse Ruderman]

Crashtest: http://hg.mozilla.org/mozilla-central/rev/f4622261cce8