Open Bug 1461124 Opened 2 years ago Updated 1 month ago

Crash in nsLineBreaker::FlushCurrentWord via nsTextFrame::ReflowText replying to email, infinite recursion in block/inline reflow

Categories

(Core :: Layout: Text and Fonts, defect, P3)

x86
Windows
defect

Tracking

()

People

(Reporter: wsmwk, Unassigned)

References

(Depends on 1 open bug, )

Details

(Keywords: crash, Whiteboard: [tbird crash])

Crash Data

#45 crash for 52.7.0.  According to stats, users on average crash twice

The typical bug comment is "replying to mail"

This bug was filed from the Socorro interface and is
report bp-17b83321-d1b9-4e2b-9572-c20360180425. (fpd)
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsLineBreaker::FlushCurrentWord dom/base/nsLineBreaker.cpp:60
1 xul.dll nsLineBreaker::AppendText dom/base/nsLineBreaker.cpp:366
2 xul.dll BuildTextRunsScanner::SetupBreakSinksForTextRun layout/generic/nsTextFrame.cpp:2617
3 xul.dll BuildTextRunsScanner::BuildTextRunForFrames layout/generic/nsTextFrame.cpp:2391
4 xul.dll BuildTextRunsScanner::FlushFrames layout/generic/nsTextFrame.cpp:1629
5 xul.dll BuildTextRunsScanner::ScanFrame layout/generic/nsTextFrame.cpp:1903
6 xul.dll BuildTextRunsScanner::ScanFrame layout/generic/nsTextFrame.cpp:1913
7 xul.dll BuildTextRuns layout/generic/nsTextFrame.cpp:1530
8 xul.dll nsTextFrame::EnsureTextRun layout/generic/nsTextFrame.cpp:2832
9 xul.dll nsTextFrame::ReflowText layout/generic/nsTextFrame.cpp:9053

=============================================================
See Also: → 520028
Firefox case is bp-0381d423-12c2-48ad-89ba-c29fb0180509.  This is stack overflow by reflow.
Component: General → Layout: Text
Product: Thunderbird → Core
Note that this may not really be a text-specific problem; the root issue is infinite recursion in block/inline reflow, and it just happens that we're looking at a text frame when the stack runs out.

See also the discussion in bug 1403656, which may be the same underlying cause.
Priority: -- → P3
See Also: → 1403656
(In reply to Jonathan Kew (:jfkthame) from comment #2)
> Note that this may not really be a text-specific problem; the root issue is
> infinite recursion in block/inline reflow, and it just happens that we're
> looking at a text frame when the stack runs out.
> 
> See also the discussion in bug 1403656, which may be the same underlying cause.

Indeed the Mac crashes I sampled in crazy old bug 520028 are also via nsTextFrame::ReflowText
Depends on: 1403656
OS: Windows 10 → Windows
See Also: 1403656
Summary: Crash in nsLineBreaker::FlushCurrentWord replying to email → Crash in nsLineBreaker::FlushCurrentWord via nsTextFrame::ReflowText replying to email
Summary: Crash in nsLineBreaker::FlushCurrentWord via nsTextFrame::ReflowText replying to email → Crash in nsLineBreaker::FlushCurrentWord via nsTextFrame::ReflowText replying to email, infinite recursion in block/inline reflow
Whiteboard: [tbird crash]
You need to log in before you can comment on or make changes to this bug.