crash in nsHTMLReflowState::ComputeContainingBlockRectangle(nsPresContext*, nsHTMLReflowState const*, int&, int&)

RESOLVED FIXED in mozilla33

Status

()

Core
Layout
--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: Martijn Wargers (zombie), Assigned: mats)

Tracking

({crash, testcase})

unspecified
mozilla33
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments, 1 obsolete attachment)

(Reporter)

Description

4 years ago
Created attachment 8448259 [details]
crash1.htm

Bug 794693 had a similar crash stack.

This crash happens when font inflation is turned on, e.g. when the value of the font.size.inflation.minTwips preference is something else than the default.

This bug was filed from the Socorro interface and is 
report bp-d087f760-cfa6-4f7a-a09b-23e5d2140630.
=============================================================
0 	XUL 	nsHTMLReflowState::ComputeContainingBlockRectangle(nsPresContext*, nsHTMLReflowState const*, int&, int&) 	layout/generic/nsHTMLReflowState.h
1 	XUL 	nsHTMLReflowState::InitConstraints(nsPresContext*, int, int, nsMargin const*, nsMargin const*, nsIAtom*) 	layout/generic/nsHTMLReflowState.cpp
2 	XUL 	nsHTMLReflowState::Init(nsPresContext*, int, int, nsMargin const*, nsMargin const*) 	layout/generic/nsHTMLReflowState.cpp
3 	XUL 	nsFontInflationData::UpdateWidth(nsHTMLReflowState const&) 	layout/generic/nsHTMLReflowState.cpp
4 	XUL 	nsFontInflationData::UpdateFontInflationDataWidthFor(nsHTMLReflowState const&) 	layout/generic/nsFontInflationData.cpp
5 	XUL 	nsHTMLReflowState::InitResizeFlags(nsPresContext*, nsIAtom*) 	layout/generic/nsHTMLReflowState.cpp
6 	XUL 	nsHTMLReflowState::Init(nsPresContext*, int, int, nsMargin const*, nsMargin const*) 	layout/generic/nsHTMLReflowState.cpp
7 	XUL 	nsFrame::DoLayout(nsBoxLayoutState&) 	layout/generic/nsHTMLReflowState.cpp
8 	XUL 	nsIFrame::Layout(nsBoxLayoutState&) 	layout/xul/nsBox.cpp
9 	XUL 	nsStackLayout::Layout(nsIFrame*, nsBoxLayoutState&) 	layout/xul/nsStackLayout.cpp
(Assignee)

Comment 1

4 years ago
Created attachment 8448350 [details]
gdb stack & data

We're setting up a nsHTMLReflowState for a nsTableFrame
when we crash.  The parent state, for an nsOuterTableFrame,
has mDummyParentReflowState == true; and its mCBReflowState
== null which we copy in InitCBReflowState():
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsHTMLReflowState.cpp#412

Then we call InitConstraints():
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsHTMLReflowState.cpp#1912
with parentReflowState != null, and 
mFlags.mDummyParentReflowState == false, so we fall into the
else block where we use mCBReflowState which is null.
(Assignee)

Comment 2

4 years ago
Created attachment 8448354 [details] [diff] [review]
wip

I think this might work - make a table reflow state have
mDummyParentReflowState=true if its parent reflow state has that.
Then we'll take the then-branch in InitConstraints().

https://tbpl.mozilla.org/?tree=Try&rev=d3219591b1a9
(Assignee)

Comment 3

4 years ago
Created attachment 8448871 [details] [diff] [review]
fix+crashtest

https://tbpl.mozilla.org/?tree=Try&rev=86be8e80e69d
https://tbpl.mozilla.org/?tree=Try&rev=d3219591b1a9
Assignee: nobody → mats
Attachment #8448354 - Attachment is obsolete: true
Attachment #8448871 - Flags: review?(roc)
(Assignee)

Comment 4

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/4a67b3d41033
Flags: in-testsuite+
OS: Mac OS X → All
https://hg.mozilla.org/mozilla-central/rev/4a67b3d41033
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla33
You need to log in before you can comment on or make changes to this bug.