490559 - Hang [@ nsBlockFrame::ReflowInlineFrames] with removing 𐶅 and small width

Status: RESOLVED FIXED

(Core :: Layout, defect, P2)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which hangs in current trunk build, it doesn't hang in Firefox 3.

The crash log, I get from my Mac debug build after it crashes because of too long hanging:
Thread 0 Crashed:
0   libSystem.B.dylib             	0x90fd8e42 __kill + 10
1   libSystem.B.dylib             	0x9104b23a raise + 26
2   libSystem.B.dylib             	0x91057679 abort + 73
3   libnspr4.dylib                	0x001497ef PR_Assert + 0 (prlog.c:547)
4   libxpcom_core.dylib           	0x0055ba9d Abort(char const*) + 21
5   libxpcom_core.dylib           	0x0055bd71 NS_DebugBreak_P + 657 (nsDebugImpl.cpp:322)
6   libgklayout.dylib             	0x12ec7c92 nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, int*) + 616 (nsBlockFrame.cpp:3293)
7   libgklayout.dylib             	0x12ec8108 nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*) + 1012 (nsBlockFrame.cpp:2317)
8   libgklayout.dylib             	0x12ec895b nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) + 1985 (nsBlockFrame.cpp:1897)
9   libgklayout.dylib             	0x12ecbc15 nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) + 795 (nsBlockFrame.cpp:944)
10  libgklayout.dylib             	0x12ecf887 nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, int, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) + 477 (nsBlockReflowContext.cpp:310)
11  libgklayout.dylib             	0x12ec5b0e nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, int*) + 2076 (nsBlockFrame.cpp:2990)
12  libgklayout.dylib             	0x12ec7e38 nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*) + 292 (nsBlockFrame.cpp:2262)
13  libgklayout.dylib             	0x12ec895b nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) + 1985 (nsBlockFrame.cpp:1897)
14  libgklayout.dylib             	0x12ecbc15 nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) + 795 (nsBlockFrame.cpp:944)
15  libgklayout.dylib             	0x12ecf887 nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, int, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) + 477 (nsBlockReflowContext.cpp:310)
etc...

Comment 1

[Martijn Wargers (dead)]

It wasn't hanging in a 2009-02-14 trunk build, so a fairly recent regression.

Comment 2

[Martijn Wargers (dead)]

This seems to have regressed between 2009-04-18 and 2009-04-20:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2009-04-18+04%3A00%3A00&enddate=2009-04-20+06%3A00%3A00

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I get a cycle of assertions during the loop:

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /home/dbaron/builds/mozilla-central/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: Text run does not map enough text for our reflow: 'gfxSkipCharsIterator(iter).ConvertOriginalToSkipped(offset + length) <= mTextRun->GetLength()', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsTextFrameThebes.cpp, line 6153
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /home/dbaron/builds/mozilla-central/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: unconstrained height on totally empty line: 'NS_UNCONSTRAINEDSIZE != aFloatAvailableSpace.mRect.height', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsBlockFrame.cpp, line 3660
###!!! ASSERTION: redo line on totally empty line with non-empty band...: 'aFloatAvailableSpace.mHasFloats', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsBlockFrame.cpp, line 3665



I verified by local backout that this was caused by
http://hg.mozilla.org/mozilla-central/rev/f9627950be8f
(I backed out some of the things on top of it first; not sure if I needed to, though)

Comment 4

[Marco Bonardo [:mak]]

is this OS X only? with current 3.5.3 the testcase hangs for me on Windows, while using current trunk it does not hang, nor with current 1.9.2.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I see this on Mac.

Comment 6

[Simon Montagu :smontagu]

Attachment: Patch

Comment 7

[Simon Montagu :smontagu]

http://hg.mozilla.org/mozilla-central/rev/fa7cae321eff

Comment 8

[Simon Montagu :smontagu]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fffed35054b5

Comment 9

[Simon Montagu :smontagu]

Comment on attachment 405136 [details] [diff] [review]
Patch

Requesting approval1.9.1 after trunk baking time, since this fixes a regression from bug 332655

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 405136 [details] [diff] [review]
Patch

Approved for 1.9.1.5, a=dveditz

Comment 11

[Simon Montagu :smontagu]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/07ff9d432dac

Comment 12

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.9.1.6 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.6pre) Gecko/20091119 Shiretoko/3.5.6pre using testcase. Saw crash with testcase in 1.9.1.5.

Verified for 1.9.2 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2b4pre) Gecko/20091123 Namoroka/3.6b4pre.