11441 - [Blocker] Crash in table reflow

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect, P3)

Description

[Syd Logan]

Contact [e-mail] for steps to reproduce.

Here is the stack trace:

nsTableFrame::DidComputeHorizontalCollapsingBorders(nsIPresContext & {...}, int
0, int 10000) line 982 + 11 bytes
nsTableFrame::ResizeReflowPass2(nsTableFrame * const 0x0ba6e620, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 2654
nsTableFrame::Reflow(nsTableFrame * const 0x0ba6e624, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 2316 + 38 bytes
nsTreeFrame::Reflow(nsTreeFrame * const 0x0ba6e624, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 294
nsContainerFrame::ReflowChild(nsIFrame * 0x0ba6e620, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x0ba6dac0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 600 + 34 bytes
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const
0x0ba6dac0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
OuterTableReflowState & {...}, unsigned int & 0) line 370 + 31 bytes
nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x0ba6dac0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0, nsIFrame * 0x0ba6e620) line 342 + 31 bytes
nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x0ba6dac0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 324 + 35 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x0ba6dac4, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 997 + 35 bytes
nsBoxFrame::FlowChildAt(nsIFrame * 0x0ba6dac0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0,
nsCalculatedBoxInfo & {...}, int & 0, nsString & {...}) line 856
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0ba6dac0, nsCalculatedBoxInfo & {...}) line 226
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3ae270, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0a3ae230, nsCalculatedBoxInfo & {...}) line 180
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3220f0, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0a3220b0, nsCalculatedBoxInfo & {...}) line 180
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3205d8, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0a320598, nsCalculatedBoxInfo & {...}) line 180
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3aac40, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::Reflow(nsBoxFrame * const 0x0a3aac04, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 322
nsContainerFrame::ReflowChild(nsIFrame * 0x0a3aac00, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
RootFrame::Reflow(RootFrame * const 0x0b3ba434, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 327
nsContainerFrame::ReflowChild(nsIFrame * 0x0b3ba430, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0b3b48f4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 513
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0babe520,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...},
nsIRenderingContext & {...}) line 169
PresShell::ProcessReflowCommands(PresShell * const 0x0b33d830) line 1184
PresShell::ExitReflowLock(PresShell * const 0x0b33d830) line 564
PresShell::ContentAppended(PresShell * const 0x0b33d838, nsIDocument *
0x0b319200, nsIContent * 0x0ba8a8f0, int 0) line 1564
XULDocumentImpl::ContentAppended(XULDocumentImpl * const 0x0b319200, nsIContent
* 0x0ba8a8f0, int 0) line 1962
RDFElementImpl::AppendChildTo(RDFElementImpl * const 0x0ba8a8f0, nsIContent *
0x0ba93fa0, int 1) line 1696

Comment 1

[Syd Logan]

Also crashes when displaying content for first time in a table that has content.

Comment 2

[Syd Logan]

Found an easy way to do this. Go to tasks menu, bring up messenger. You will get
a couple of unrelated asserts, which you can F5 through, and then you will crash
with the same stack trace I was seeing.

Comment 3

[lchiang]

cc: bienvenu and putterman since syd had mentioned messenger below.

Comment 4

[David :Bienvenu]

yes, I see the same crash. this is very recent - i think it started happening
yesterday.

Comment 5

[scottputterman]

Try backing out the recent changes to layout/base/src/nsStyleContext.cpp and see
if this goes away for you.  It did for me.

Comment 6

[David :Bienvenu]

Yes, I believe this is fixed by backing out the nsStylecontext change, which dp
has done.

Comment 7

[David :Bienvenu]

From Peter Lins:

No, absolutely not. The bug should be noted so that the crash only happens if
'border-collapse' is set to 'collapse' (which is all my change did). This is a
perfectly legal value and table reflow should not crash due to it. (This value
can be set via a style sheet and still cause the crash)

So I'm re-opening. It's no longer a blocker for Mail/News - I'll leave it up to
syd to say if he's still blocked/

Comment 8

[Christine Hoffman]

If this bug is not fixed, please remove the resolution. Thanks

Comment 9

[David :Bienvenu]

clearing resolution

Comment 10

[scottputterman]

It looks like we're seeing this same crash in the address book on Linux Bug
11468. I'm pretty sure that is from after we backed out nsStyleContext.cpp.  So
it looks like we still have a problem.

Comment 11

[karnaze (gone)]

Syd, If backing out the style changes, didn't fix the crash for you, please
change the status back. I'm marking this remind, since I don't have a test case.

Comment 12

[Christine Hoffman]

Verified Remind.

Comment 13

[Syd Logan]

Looks to me like it is basically working again.

Comment 14

[Christopher Hoess (gone)]

REMIND is deprecated.

Comment 15

[Christopher Hoess (gone)]

FIXED per syd's comment.