1338007 - stylo: layout/generic/crashtests/309322-1.html crashes in nsIFrame::SetNextSibling

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Cameron McCormack (:heycam)]

layout/generic/crashtests/309322-1.html produces a number of assertions and then crashes.

###!!! ASSERTION: How did we get here?  Frame construction screwed up: 'Not Reached', file /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp, line 2353
###!!! ASSERTION: How did this produce an nsTableRowGroupFrame?: 'Not Reached', file /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp, line 2862
###!!! ASSERTION: How did this produce an nsTableRowGroupFrame?: 'Not Reached', file /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp, line 2862
###!!! ASSERTION: not in child list: 'found', file /home/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp, line 1505
###!!! ASSERTION: can't remove inner frame: 'kCaptionList == aListID', file /home/worker/workspace/build/src/layout/tables/nsTableWrapperFrame.cpp, line 153
###!!! ASSERTION: Broken frame linkage: 'prevSibling && prevSibling->GetNextSibling() == aFrame', file /home/worker/workspace/build/src/layout/generic/nsFrameList.cpp, line 91
###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aNextSibling', file /home/worker/workspace/build/src/layout/generic/nsIFrame.h, line 1453

Crash reason:  SIGSEGV
Crash address: 0x30

libxul.so!nsIFrame::SetNextSibling [nsIFrame.h:8a0041a6365b : 1454 + 0x0]
libxul.so!nsFrameList::RemoveFrame [nsFrameList.cpp:8a0041a6365b : 92 + 0xb]
libxul.so!nsFrameList::DestroyFrame [nsFrameList.cpp:8a0041a6365b : 137 + 0xb]
libxul.so!nsTableWrapperFrame::RemoveFrame [nsTableWrapperFrame.cpp:8a0041a6365b : 162 + 0xc]
libxul.so!nsFrameManager::RemoveFrame [nsFrameManager.cpp:8a0041a6365b : 506 + 0x13]
libxul.so!nsCSSFrameConstructor::ContentRemoved [nsCSSFrameConstructor.cpp:8a0041a6365b : 8526 + 0x15]
libxul.so!nsCSSFrameConstructor::RecreateFramesForContent [nsCSSFrameConstructor.cpp:8a0041a6365b : 9716 + 0x5]
libxul.so!mozilla::RestyleManagerBase::ProcessRestyledFrames [RestyleManagerBase.cpp:8a0041a6365b : 1183 + 0x17]
libxul.so!mozilla::ServoRestyleManager::ProcessPendingRestyles [ServoRestyleManager.cpp:8a0041a6365b : 369 + 0xb]
libxul.so!mozilla::PresShell::FlushPendingNotifications [PresShell.cpp:8a0041a6365b : 4171 + 0x23]
libxul.so!mozilla::PresShell::FlushPendingNotifications [PresShell.cpp:8a0041a6365b : 4061 + 0x7]
libxul.so!nsDocument::FlushPendingNotifications [nsDocument.cpp:8a0041a6365b : 7962 + 0x6]
libxul.so!mozilla::dom::Element::GetPrimaryFrame [Element.cpp:8a0041a6365b : 2167 + 0xc]
libxul.so!mozilla::dom::Element::GetBoundingClientRect [Element.cpp:8a0041a6365b : 970 + 0xb]
libxul.so!mozilla::dom::ElementBinding::getBoundingClientRect [ElementBinding.cpp:8a0041a6365b : 2085 + 0x8]
libxul.so!mozilla::dom::GenericBindingMethod [BindingUtils.cpp:8a0041a6365b : 2959 + 0x6]
libxul.so!js::CallJSNative [jscntxtinlines.h:8a0041a6365b : 281 + 0x6]
libxul.so!js::InternalCallOrConstruct [Interpreter.cpp:8a0041a6365b : 460 + 0x16]
libxul.so!js::Call [Interpreter.cpp:8a0041a6365b : 524 + 0x5]
libxul.so!js::jit::InvokeFunction [VMFunctions.cpp:8a0041a6365b : 114 + 0x5]

Comment 1

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/76831b11ec44
Remove comments from already re-enabled tests. r=me (DONTBUILD)

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/76831b11ec44