17636 - Browser crashes loading page

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Michael Lowe]

1999103008 build

Comment 1

[troy]

Kipp, what I see with my build is that a call to the space manager's
AddRectRegion() function returns NS_ERROR_FAILURE because the frame is already
associated with a region.

That causes us to trip an assert in the block reflow state's PlaceFloater()
function.

The space manager hasn't changed so I'm guessing it's related to your recent
changes.

Here's the stack trace:

nsSpaceManager::AddRectRegion(nsSpaceManager * const 0x01c5a4c8, nsIFrame *
0x01c49458, const nsRect & {...}) line 712
nsBlockReflowState::PlaceFloater(nsFloaterCache * 0x01c5bfd8, int * 0x0012bcc4)
line 5419 + 26 bytes
nsBlockReflowState::AddFloater(nsLineLayout & {...}, nsPlaceholderFrame *
0x01c496c0, int 0) line 5172
nsLineLayout::AddFloater(nsPlaceholderFrame * 0x01c496c0) line 548
nsLineLayout::ReflowFrame(nsIFrame * 0x01c496c0, nsIFrame * * 0x0012bf04,
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000) line 962
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x01c92420, const
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame *
0x01c496c0, unsigned int & 0) line 1550 + 22 bytes
nsInlineFrame::ReflowInlineFrames(nsIPresContext * 0x01c92420, const
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...},
nsHTMLReflowMetrics & {...}, unsigned int & 0) line 1396 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x01c48f00, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1316 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x01c48f00, nsIFrame * * 0x0012cd3c,
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000) line 941
nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineLayout &
{...}, nsLineBox * 0x01c5fa60, nsIFrame * 0x01c48f00, unsigned char *
0x0012c0e0) line 3650 + 28 bytes
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & {...}, nsLineLayout &
{...}, nsLineBox * 0x01c5fa60, int * 0x0012ca3c, unsigned char * 0x0012c8dc)
line 3540 + 28 bytes
nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState & {...}, nsLineBox *
0x01c5fa60, int * 0x0012ca3c, unsigned char * 0x0012c8dc) line 3486 + 34 bytes
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineBox *
0x01c5fa60, int * 0x0012ca3c) line 3434 + 24 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01c5fa60, int
* 0x0012ca3c, int 1) line 2661 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2421 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x00ede5e0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1485 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00ede5e0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 367 + 31 bytes
nsTableCellFrame::Reflow(nsTableCellFrame * const 0x00ede548, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 648
nsContainerFrame::ReflowChild(nsIFrame * 0x00ede548, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 367 + 31 bytes
nsTableRowFrame::IR_TargetIsChild(nsTableRowFrame * const 0x00eddfe0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0, nsIFrame * 0x00ede548) line 1285 + 34 bytes
nsTableRowFrame::IncrementalReflow(nsTableRowFrame * const 0x00eddfe0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0) line 1173 + 35 bytes
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x00eddfe0, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1447 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00eddfe0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 367 + 31 bytes
nsTableRowGroupFrame::IR_TargetIsChild(nsTableRowGroupFrame * const 0x00edda20,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState &
{...}, unsigned int & 0, nsIFrame * 0x00eddfe0) line 1501 + 34 bytes
nsTableRowGroupFrame::IncrementalReflow(nsTableRowGroupFrame * const 0x00edda20,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState &
{...}, unsigned int & 0) line 1108 + 35 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x00edda20,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 1017 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00edda20, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 367 + 31 bytes
nsTableFrame::IR_TargetIsChild(nsTableFrame * const 0x00edd3b8, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, InnerTableReflowState & {...}, unsigned int
& 0, nsIFrame * 0x00edda20) line 2346 + 34 bytes
nsTableFrame::IncrementalReflow(nsTableFrame * const 0x00edd3b8, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 2178 + 41 bytes
nsTableFrame::Reflow(nsTableFrame * const 0x00edd3b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1219 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00edd3b8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 367 + 31 bytes
nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x00edd330,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 576 + 34 bytes
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const
0x00edd330, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
OuterTableReflowState & {...}, unsigned int & 0) line 371 + 31 bytes
nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x00edd330,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0, nsIFrame * 0x00edd3b8) line 344 + 31 bytes
nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x00edd330,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 327 + 35 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x00edd330, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 848 + 31 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x00edd330, const nsRect & {...},
int 0, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 248 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x00f0ef70, int * 0x0012e300) line 3222 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x00f0ef70, int
* 0x0012e300, int 1) line 2610 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2421 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x00ec91f8, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1485 + 15 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x00ec91f8, const nsRect & {...},
int 1, int 0, int 1, nsMargin & {...}, unsigned int & 0) line 248 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x00ec9350, int * 0x0012eb98) line 3222 + 59 bytes

Comment 2

[kipp]

Attachment: a reduced testcase that triggers the same crash

Comment 3

[kipp]

Updated priority and summary since it's a crash, not a freeze.

Comment 4

[kipp]

Interesting case. fixed...

Comment 5

[Chris Petersen]

With the Nov 15th build (1999111508) , the both url and test case loadwithout
causing a crash.