1215170 - combox/select can hang firefox on Linux

Status: RESOLVED INCOMPLETE

(Core :: Layout: Form Controls, defect)

Description

[Tom Hindle]

Attachment: Test.html

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Build ID: 20141011015303

Steps to reproduce:

1. Open attached html test program in Firefox on Linux.
(Tested with cinnamon:
XDG_CURRENT_DESKTOP="X-Cinnamon"
XDG_SESSION_DESKTOP="cinnamon")
2. Position firefox vertically so that the drop down of the select is right on the edge of when the vertical scrollbar appears.
3. Click the drop down.
4. If no hang and the scrollbar is shown move firefox up the smallest number of pixels you can manage - goto 3.
5. If no hang and the scrollbar is not shown move firefox down the smallest number of pixels you can manage - goto 3.

Hint: if scrollbar is always shown (due to low resolution screen of something 



Actual results:

Firefox hang. (Well actually very high cpu caused by AsyncResize constantly running making the appearance of a hang)

Example stack trace:
0x00007f6e12a9bfdb in nsListControlFrame::ReflowAsDropdown (
    this=this@entry=0x7f6e0063a6e8,
    aPresContext=aPresContext@entry=0x7f6e00786000, aDesiredSize=...,
    aReflowState=..., aStatus=@0x7ffeb83dba44: 0)
    at /home/hindlet/src/mozilla-release/layout/forms/nsListControlFrame.cpp:548
#12 0x00007f6e12a9c5ca in nsListControlFrame::Reflow (this=0x7f6e0063a6e8,
    aPresContext=0x7f6e00786000, aDesiredSize=..., aReflowState=...,
    aStatus=@0x7ffeb83dba44: 0)
    at /home/hindlet/src/mozilla-release/layout/forms/nsListControlFrame.cpp:363
#13 0x00007f6e12a47c9c in nsContainerFrame::ReflowChild (this=<optimized out>,
    aKidFrame=0x7f6e0063a6e8, aPresContext=0x7f6e00786000, aDesiredSize=...,
    aReflowState=..., aX=0, aY=0, aFlags=15, aStatus=@0x7ffeb83dba44: 0,
    aTracker=0x0)
    at /home/hindlet/src/mozilla-release/layout/generic/nsContainerFrame.cpp:938
#14 0x00007f6e12a95522 in nsComboboxControlFrame::ReflowDropdown (
    this=this@entry=0x7f6e0063a090,
    aPresContext=aPresContext@entry=0x7f6e00786000, aReflowState=...)
    at /home/hindlet/src/mozilla-release/layout/forms/nsComboboxControlFrame.cpp:451
#15 0x00007f6e12a968aa in nsComboboxControlFrame::Reflow (this=0x7f6e0063a090,
    aPresContext=0x7f6e00786000, aDesiredSize=..., aReflowState=...,
    aStatus=@0x7ffeb83dbf34: 0)
    at /home/hindlet/src/mozilla-release/layout/forms/nsComboboxControlFrame.cpp:804
#16 0x00007f6e12a36f97 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame (
    this=this@entry=0x7f6dfec79500,
    aDelegatingFrame=aDelegatingFrame@entry=0x7f6e006ae5a8,
---Type <return> to continue, or q <return> to quit---
    aPresContext=aPresContext@entry=0x7f6e00786000, aReflowState=...,
    aContainingBlock=..., aConstrainHeight=aConstrainHeight@entry=true,
    aKidFrame=aKidFrame@entry=0x7f6e0063a090, aStatus=@0x7ffeb83dbf34: 0,
    aOverflowAreas=aOverflowAreas@entry=0x7ffeb83dc40c)
    at /home/hindlet/src/mozilla-release/layout/generic/nsAbsoluteContainingBlock.cpp:407
#17 0x00007f6e12a37359 in nsAbsoluteContainingBlock::Reflow (
    this=this@entry=0x7f6dfec79500,
    aDelegatingFrame=aDelegatingFrame@entry=0x7f6e006ae5a8,
    aPresContext=aPresContext@entry=0x7f6e00786000, aReflowState=...,
    aReflowStatus=@0x7ffeb83dc170: 0, aContainingBlock=...,
    aConstrainHeight=aConstrainHeight@entry=true, aCBWidthChanged=false,
    aCBHeightChanged=false, aOverflowAreas=aOverflowAreas@entry=0x7ffeb83dc40c)
    at /home/hindlet/src/mozilla-release/layout/generic/nsAbsoluteContainingBlock.cpp:131
#18 0x00007f6e12a3ed6d in nsBlockFrame::Reflow (this=0x7f6e006ae5a8,
    aPresContext=0x7f6e00786000, aMetrics=..., aReflowState=...,
    aStatus=@0x7ffeb83dc5d4: 0)
    at /home/hindlet/src/mozilla-release/layout/generic/nsBlockFrame.cpp:1301
#19 0x00007f6e12a36f97 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame (
    this=this@entry=0x7f6dfec79520,
    aDelegatingFrame=aDelegatingFrame@entry=0x7f6e006ae1f0,
    aPresContext=aPresContext@entry=0x7f6e00786000, aReflowState=...,
    aContainingBlock=..., aConstrainHeight=aConstrainHeight@entry=true,
    aKidFrame=aKidFrame@entry=0x7f6e006ae5a8, aStatus=@0x7ffeb83dc5d4: 0,
    aOverflowAreas=aOverflowAreas@entry=0x7ffeb83dcaac)
    at /home/hindlet/src/mozilla-release/layout/generic/nsAbsoluteContainingBlock.cpp:407
#20 0x00007f6e12a37359 in nsAbsoluteContainingBlock::Reflow (
    this=this@entry=0x7f6dfec79520,
    aDelegatingFrame=aDelegatingFrame@entry=0x7f6e006ae1f0,
    aPresContext=aPresContext@entry=0x7f6e00786000, aReflowState=...,
    aReflowStatus=@0x7ffeb83dc810: 0, aContainingBlock=...,
    aConstrainHeight=aConstrainHeight@entry=true, aCBWidthChanged=false,
    aCBHeightChanged=false, aOverflowAreas=aOverflowAreas@entry=0x7ffeb83dcaac)
    at /home/hindlet/src/mozilla-release/layout/generic/nsAbsoluteContainingBlock.cpp:131
#21 0x00007f6e12a3ed6d in nsBlockFrame::Reflow (this=0x7f6e006ae1f0,
    aPresContext=0x7f6e00786000, aMetrics=..., aReflowState=...,
    aStatus=@0x7ffeb83dcc74: 0)
    at /home/hindlet/src/mozilla-release/layout/generic/nsBlockFrame.cpp:1301
#22 0x00007f6e12a36f97 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame (
    this=this@entry=0x7f6e19bee920,
    aDelegatingFrame=aDelegatingFrame@entry=0x7f6e00650450,
    aPresContext=aPresContext@entry=0x7f6e00786000, aReflowState=...,
    aContainingBlock=..., aConstrainHeight=aConstrainHeight@entry=false,
    aKidFrame=aKidFrame@entry=0x7f6e006ae1f0, aStatus=@0x7ffeb83dcc74: 0,
    aOverflowAreas=aOverflowAreas@entry=0x7ffeb83dcf5c)
    at /home/hindlet/src/mozilla-release/layout/generic/nsAbsoluteContainingBlock.cpp:407
#23 0x00007f6e12a37359 in nsAbsoluteContainingBlock::Reflow (
    this=0x7f6e19bee920,
    aDelegatingFrame=aDelegatingFrame@entry=0x7f6e00650450,
    aPresContext=aPresContext@entry=0x7f6e00786000, aReflowState=...,
    aReflowStatus=@0x7ffeb83dceec: 0, aContainingBlock=...,
    aConstrainHeight=aConstrainHeight@entry=false,
    aCBWidthChanged=aCBWidthChanged@entry=true,
    aCBHeightChanged=aCBHeightChanged@entry=true,
    aOverflowAreas=aOverflowAreas@entry=0x7ffeb83dcf5c)
    at /home/hindlet/src/mozilla-release/layout/generic/nsAbsoluteContainingBlock.cpp:131
#24 0x00007f6e12a9330f in ViewportFrame::Reflow (this=0x7f6e00650450,
    aPresContext=0x7f6e00786000, aDesiredSize=..., aReflowState=...,
    aStatus=@0x7ffeb83dceec: 0)
    at /home/hindlet/src/mozilla-release/layout/generic/nsViewportFrame.cpp:262
#25 0x00007f6e129c9ace in PresShell::DoReflow (this=this@entry=0x7f6e0062b000,
    target=target@entry=0x7f6e00650450,
    aInterruptible=aInterruptible@entry=false)
    at /home/hindlet/src/mozilla-release/layout/base/nsPresShell.cpp:8827
#26 0x00007f6e129cb23c in PresShell::ProcessReflowCommands (
    this=this@entry=0x7f6e0062b000, aInterruptible=false)
    at /home/hindlet/src/mozilla-release/layout/base/nsPresShell.cpp:8983
#27 0x00007f6e129cd2a2 in PresShell::FlushPendingNotifications (
    this=0x7f6e0062b000, aFlush=...)
    at /home/hindlet/src/mozilla-release/layout/base/nsPresShell.cpp:4248
#28 0x00007f6e129c24ab in PresShell::FlushPendingNotifications (
    this=<optimized out>, aType=<optimized out>)
    at /home/hindlet/src/mozilla-release/layout/base/nsPresShell.cpp:4086
#29 0x00007f6e12a96e90 in nsAsyncResize::Run (this=0x7f6dfec2dc20)
    at /home/hindlet/src/mozilla-release/layout/forms/nsComboboxControlFrame.cpp:524
#30 0x00007f6e11a237ec in nsThread::ProcessNextEvent (this=0x7f6e160b53a0,
    aMayWait=<optimized out>, aResult=0x7ffeb83dd3bf)
    at /home/hindlet/src/mozilla-release/xpcom/threads/nsThread.cpp:770
#31 0x00007f6e119de3cf in NS_ProcessPendingEvents (
    aThread=aThread@entry=0x7f6e160b53a0, aTimeout=20)
    at /home/hindlet/src/mozilla-release/xpcom/glue/nsThreadUtils.cpp:207
#32 0x00007f6e12414898 in nsBaseAppShell::NativeEventCallback (
    this=this@entry=0x7f6e0aae0e80)
    at /home/hindlet/src/mozilla-release/widget/xpwidgets/nsBaseAppShell.cpp:98


I suspect the cause of the problem has something to do with:

 } else if (height > (dropdownSize.height + lcf->GetHeightOfARow() * 1.5) &&
            lcf->GetDropdownCanGrow()) {
    // The drop-down fits but there is room for at least 1.5 more rows -
    // schedule a resize to show more rows if it has more rows to show.
    // (1.5 rows for good measure to avoid any rounding issues that would
    // lead to a loop of reflow requests)
    NS_DispatchToCurrentThread(new nsAsyncResize(this));
    return eDropDownPositionPendingResize;
  }

#0  nsComboboxControlFrame::AbsolutelyPositionDropDown (this=0x7f6dffc50090)
    at /home/hindlet/src/mozilla-release/layout/forms/nsComboboxControlFrame.cpp:630

As the NS_DispatchToCurrentThread(new nsAsyncResize(this)); line is constantly being called.




Expected results:

Firefox should not hang.

Comment 1

[Tom Hindle]

Also reproducible on 14.04 Ubuntu (Unity)
XDG_CURRENT_DESKTOP="Unity"
GDMSESSION="ubuntu"

Comment 2

[Nigel Babu [:nigelb]]

I can confirm this happens on both Aurora and Nightly. I've had to force kill my browser a few times in the last week.

Comment 3

[Karl Tomlinson (:karlt)]

(In reply to Tom Hindle from comment #0)
> Hint: if scrollbar is always shown (due to low resolution screen of something 

Scrollbar is always shown for me even though there is plenty of screen to show the whole select, so I can't reproduce.

Comment 2 suggests this may be a regression.

Comment 4

[Tom Hindle]

(In reply to Karl Tomlinson (ni?:karlt) from comment #3)
> (In reply to Tom Hindle from comment #0)
> > Hint: if scrollbar is always shown (due to low resolution screen of something 
> 
> Scrollbar is always shown for me even though there is plenty of screen to
> show the whole select, so I can't reproduce.

I think the comment should have continued - ") maybe reduce the number of items in the select"

> 
> Comment 2 suggests this may be a regression.


I initially saw the bug testing with Gecko 33.0.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

(In reply to Nigel Babu [:nigelb] from comment #2)
> I can confirm this happens on both Aurora and Nightly. I've had to force
> kill my browser a few times in the last week.

Want to try tracking this down with mozregression, Nigel? :)

Comment 6

[Nigel Babu [:nigelb]]

I'd love to, but I can't successfully reproduce this on demand yet. Tom, I haven't understood what you mean by Step 2 in the Steps to Reproduce. Can you explain that further?

Comment 7

[Tom Hindle]

(In reply to Nigel Babu [:nigelb] from comment #6)
> I'd love to, but I can't successfully reproduce this on demand yet. Tom, I
> haven't understood what you mean by Step 2 in the Steps to Reproduce. Can
> you explain that further?

(sorry for the following over-the-top explanation - but I hope it makes thing clear.) 

When a combo/select dropdown menu is displayed, it may or may not display a vertical scrollbar.
The scrollbar visiblity is determined by a number of factors,
1. The resolution of the screen.
2. The position of the fireofox window on the screen.
3. The number of items in the select box. (+plus lots of other factors to determine size of dropdown)
4. The position of the select in the html page.

If firefox thinks that the size of the dropdown will extend pass the 'bottom of the screen'/'top of taskbar' (OS dependent) then it will reduce the size of the (floating/outer) dropdown window and add a vertical scrollbar.

Given a fixed number of items in the select box and a fixed html page, and a fixed resolution - if one moves the firefox window position, one can alter the visibility of the scrollbar.

So "2. Position firefox vertically so that the drop down of the select is right on the edge of when the vertical scrollbar appears."

Means move the firefox window to the position where moving it up or down by a few pixels affects the visibility of the scrollbar.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Tom, are you willing to try bisecting the cause of this regression?

We have a tool, mozregression (available on pypi), that automates the process if you're able to reproduce on demand. A command like |mozregression --good 32 --bad 33| should be all you need to do to get started and the entire process shouldn't take more than 10-15min. In the end, you'll end up with a mozilla-central pushlog link that should hopefully help give some indication of what caused the problem.
http://mozilla.github.io/mozregression/

Thanks!

Comment 9

[Liviu Cirdei]

User Agent 	Mozilla/5.0 (X11; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID 	20160202030232
OS: Ubuntu 15.04

I could reproduce the issue on Firefox 40 but not on Firefox 44 or Nightly 47.0a1. 

@Tom, are you still able to reproduce the issue on these versions?

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Calling this incomplete based on the lack of reply. Tom, feel free to reopen the bug if it still reproduces for you on newer versions.