217903 - ###!!! ASSERTION: prev sibling not in line list: 'Not Reached', file i:/build/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4679

Status: RESOLVED FIXED

(Core :: Layout: Block and Inline, defect)

Description

[timeless]

viewer, cvs debug build from mid last week. i was playing w/ edit mode. i've hit
a bunch of other assertions already, but this was my first not reached...

###!!! ASSERTION: prev sibling not in line list: 'Not Reached', file
i:/build/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 4679

    // Find the line that contains the previous sibling
    if (! nsLineBox::RFindLineContaining(aPrevSibling,
                                         begin_lines(), prevSibLine,
                                         &prevSiblingIndex)) {
      // Note: defensive code! RFindLineContaining must not return
      // false in this case, so if it does...
      NS_NOTREACHED("prev sibling not in line list");

nsBlockFrame::AddFrames(nsIPresContext * 0x080a50f0, nsIFrame * 0x081aaf34,
nsIFrame * 0x081b2cfc) line 4679 + 26 bytes
nsBlockFrame::InsertFrames(nsBlockFrame * const 0x081b20ac, nsIPresContext *
0x080a50f0, nsIPresShell & {...}, nsIAtom * 0x00000000 {???}, nsIFrame *
0x081b2cfc, nsIFrame * 0x081aaf34) line 4642 + 20 bytes
FrameManager::InsertFrames(FrameManager * const 0x080ba6f0, nsIFrame *
0x081b20ac, nsIAtom * 0x00000000 {???}, nsIFrame * 0x081b2cfc, nsIFrame *
0x081aaf34) line 972
nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x080a7ab0,
nsIPresContext * 0x080a50f0, nsIContent * 0x081197c0, nsIFrame * 0x00000000,
nsIContent * 0x0811a7e0, int 1, nsILayoutHistoryState * 0x00000000, int 1) line 9081
nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x080a7ab0,
nsIPresContext * 0x080a50f0, nsIContent * 0x081197c0, nsIContent * 0x0811a7e0,
nsIContent * 0x0811a7e0, int 1) line 9149 + 34 bytes
nsCSSFrameConstructor::ContentChanged(nsCSSFrameConstructor * const 0x080a7ab0,
nsIPresContext * 0x080a50f0, nsIContent * 0x0811a7e0, nsISupports * 0x00000000)
line 9954 + 37 bytes
StyleSetImpl::ContentChanged(StyleSetImpl * const 0x080a7d20, nsIPresContext *
0x080a50f0, nsIContent * 0x0811a7e0, nsISupports * 0x00000000) line 1669
PresShell::ContentChanged(PresShell * const 0x080b879c, nsIDocument *
0x00b02da0, nsIContent * 0x0811a7e0, nsISupports * 0x00000000) line 5275 + 36 bytes
nsDocument::ContentChanged(nsDocument * const 0x00b02da0, nsIContent *
0x0811a7e0, nsISupports * 0x00000000) line 2020
nsGenericDOMDataNode::SetText(nsGenericDOMDataNode * const 0x0811a7e0, const
nsAString & {...}, int 1) line 1298
nsGenericDOMDataNode::SetData(const nsAString & {...}) line 375 + 21 bytes
nsTextNode::SetData(nsTextNode * const 0x0811a7fc, const nsAString & {...}) line
59 + 18 bytes
nsEditor::JoinNodesImpl(nsIDOMNode * 0x0811a7fc, nsIDOMNode * 0x081145ec,
nsIDOMNode * 0x081197e4, int 0) line 2984
JoinElementTxn::DoTransaction(JoinElementTxn * const 0x0814b490) line 111 + 49 bytes
nsTransactionItem::DoTransaction() line 181 + 18 bytes
nsTransactionManager::BeginTransaction(nsITransaction * 0x0814b490) line 1079 +
11 bytes
nsTransactionManager::DoTransaction(nsTransactionManager * const 0x08144370,
nsITransaction * 0x0814b490) line 133 + 18 bytes
nsEditor::DoTransaction(nsEditor * const 0x08132d80, nsITransaction *
0x0814b490) line 531 + 30 bytes
nsEditor::JoinNodes(nsEditor * const 0x08132d80, nsIDOMNode * 0x081145ec,
nsIDOMNode * 0x0811a7fc, nsIDOMNode * 0x081197e4) line 1300 + 16 bytes
nsEditor::JoinNodeDeep(nsIDOMNode * 0x08114724, nsIDOMNode * 0x081197e4,
nsCOMPtr<nsIDOMNode> * 0x0012ee78 {0x0811a7fc}, int * 0x0012ee74) line 4174 + 42
bytes
nsHTMLEditRules::WillDeleteSelection(nsISelection * 0x080bab80, short 2, int *
0x0012ef28, int * 0x0012ef64) line 2308 + 55 bytes
nsHTMLEditRules::WillDoAction(nsHTMLEditRules * const 0x08144984, nsISelection *
0x080bab80, nsRulesInfo * 0x0012ef2c, int * 0x0012ef28, int * 0x0012ef64) line
591 + 31 bytes
nsPlaintextEditor::DeleteSelection(nsPlaintextEditor * const 0x08132d80, short
2) line 863 + 59 bytes
nsTextEditorKeyListener::KeyPress(nsTextEditorKeyListener * const 0x081441d0,
nsIDOMEvent * 0x08149ba8) line 203
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x080ba310,
nsIPresContext * 0x080a50f0, nsEvent * 0x0012f9ec, nsIDOMEvent * * 0x0012f680,
nsIDOMEventTarget * 0x00b02dd4, unsigned int 514, nsEventStatus * 0x0012f818)
line 1634 + 41 bytes
nsDocument::HandleDOMEvent(nsDocument * const 0x00b02da0, nsIPresContext *
0x080a50f0, nsEvent * 0x0012f9ec, nsIDOMEvent * * 0x0012f680, unsigned int 514,
nsEventStatus * 0x0012f818) line 3806
nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x080a41c0,
nsIPresContext * 0x080a50f0, nsEvent * 0x0012f9ec, nsIDOMEvent * * 0x0012f680,
unsigned int 519, nsEventStatus * 0x0012f818) line 2035 + 47 bytes
PresShell::HandleEventInternal(nsEvent * 0x0012f9ec, nsIView * 0x080a64e0,
unsigned int 1, nsEventStatus * 0x0012f818) line 6236 + 45 bytes
PresShell::HandleEvent(PresShell * const 0x080b8798, nsIView * 0x080a64e0,
nsGUIEvent * 0x0012f9ec, nsEventStatus * 0x0012f818, int 1, int & 1) line 6106 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x080a64e0, nsGUIEvent * 0x0012f9ec, int 0)
line 2255
nsView::HandleEvent(nsViewManager * 0x080a68c0, nsGUIEvent * 0x0012f9ec, int 0)
line 305
nsViewManager::DispatchEvent(nsViewManager * const 0x080a68c0, nsGUIEvent *
0x0012f9ec, nsEventStatus * 0x0012f95c) line 2038 + 23 bytes
HandleEvent(nsGUIEvent * 0x0012f9ec) line 79
nsWindow::DispatchEvent(nsWindow * const 0x080a63e4, nsGUIEvent * 0x0012f9ec,
nsEventStatus & nsEventStatus_eIgnore) line 1049 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f9ec) line 1070
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 8,
long 0) line 2911 + 15 bytes
nsWindow::OnChar(unsigned int 8, unsigned int 8, unsigned char 0) line 3098
nsWindow::ProcessMessage(unsigned int 258, unsigned int 8, long 917505, long *
0x0012fe58) line 3806 + 41 bytes
nsWindow::WindowProc(HWND__ * 0x000c05f0, unsigned int 258, unsigned int 8, long
917505) line 1332 + 27 bytes
USER32! SetTimer + 1077 bytes
USER32! DispatchMessageW + 278 bytes
USER32! DispatchMessageA + 11 bytes
main(int 1, char * * 0x00a141f0) line 158 + 11 bytes
mainCRTStartup() line 338 + 17 bytes

Comment 1

[Jaime Mitchell (use [e-mail] for email)]

http://slashdot.org/articles/05/08/06/177251.shtml?tid=109&tid=152 shows the
same assertion but with a different line (new assertion or just file changes?)

###!!! ASSERTION: prev sibling not in line list: 'Not Reached', file c:/mozilla/
mozilla/layout/generic/nsBlockFrame.cpp, line 5277

Stack:
 	ntdll.dll!7c901230() 	
>	xpcom_core.dll!nsDebugImpl::Break(const char * aFile=0x00d960ec, int
aLine=5277)  Line 344	C++
 	xpcom_core.dll!nsDebugImpl::Assertion(const char * aStr=0x00d96bd4, const char
* aExpr=0x00000004, const char * aFile=0x00d960ec, int aLine=5277)  Line 260	C++
 	xpcom_core.dll!nsDebug::Assertion(const char * aStr=0x00d96bd4, const char *
aExpr=0x00d168e4, const char * aFile=0x00d960ec, int aLine=5277)  Line 109	C++
 	firefox.exe!nsBlockFrame::AddFrames(nsIFrame * aFrameList=0x0529ef58, nsIFrame
* aPrevSibling=0x00000000)  Line 5279	C++
 	firefox.exe!nsBlockFrame::SetInitialChildList(nsPresContext *
aPresContext=0x04512518, nsIAtom * aListName=0x00000000, nsIFrame *
aChildList=0x04fd69bc)  Line 7160	C++
 	firefox.exe!nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState &
aState={...}, const nsStyleDisplay * aDisplay=0x04fccaf0, nsIContent *
aContent=0x051ea4d8, nsIFrame * aParentFrame=0x04fd2bf8, nsIFrame *
aContentParentFrame=0x00000000, nsStyleContext * aStyleContext=0x00000000,
nsIFrame * * aNewFrame=0x0012f69c, nsFrameItems & aFrameItems={...}, int
aAbsPosContainer=0)  Line 12883	C++
 
firefox.exe!nsCSSFrameConstructor::ConstructFrameByDisplayType(nsFrameConstructorState
& aState={...}, const nsStyleDisplay * aDisplay=0x010fe228, nsIContent *
aContent=0x051ea4d8, int aNameSpaceID=0, nsIAtom * aTag=0x010fe388, nsIFrame *
aParentFrame=0x04fd2bf8, nsStyleContext * aStyleContext=0x04fd2d2c, nsFrameItems
& aFrameItems={...}, int aHasPseudoParent=0)  Line 6687	C++
 
firefox.exe!nsCSSFrameConstructor::ConstructFrameInternal(nsFrameConstructorState
& aState={...}, nsIContent * aContent=0x051ea4d8, nsIFrame *
aParentFrame=0x00000000, nsIAtom * aTag=0x010fe388, int aNameSpaceID=0,
nsStyleContext * aStyleContext=0x04fd2d2c, nsFrameItems & aFrameItems={...}, int
aXBLBaseTag=0)  Line 7668 + 0x1e	C++
 	firefox.exe!nsCSSFrameConstructor::ConstructFrame(nsFrameConstructorState &
aState={...}, nsIContent * aContent=0x00000000, nsIFrame *
aParentFrame=0x04fd2bf8, nsFrameItems & aFrameItems={...})  Line 7498	C++
 	firefox.exe!nsCSSFrameConstructor::ContentAppended(nsIContent *
aContainer=0x0012f77c, int aNewIndexInContainer=1242700)  Line 8586 + 0x16	C++
 	firefox.exe!PresShell::ContentAppended(nsIDocument * aDocument=0x043c6870,
nsIContent * aContainer=0x04f1d030, int aNewIndexInContainer=2)  Line 5470	C++
 	firefox.exe!nsDocument::ContentAppended(nsIContent * aContainer=0x04f1d030,
int aNewIndexInContainer=2)  Line 2211	C++
 	firefox.exe!nsHTMLDocument::ContentAppended(nsIContent *
aContainer=0x04f1d030, int aNewIndexInContainer=2)  Line 1100 + 0xc	C++
 	firefox.exe!HTMLContentSink::NotifyAppend(nsIContent * aContainer=0x04f1d030,
unsigned int aStartIndex=2)  Line 3882	C++
 	firefox.exe!SinkContext::CloseContainer(nsHTMLTag aTag=eHTMLTag_td)  Line 1300	C++
 	firefox.exe!HTMLContentSink::CloseContainer(nsHTMLTag aTag=eHTMLTag_td) 
Line 2916	C++
 	firefox.exe!CNavDTD::CloseContainer(nsHTMLTag aTag=eHTMLTag_td, nsHTMLTag
aTarget=eHTMLTag_td, int aClosedByStartTag=0)  Line 3326 + 0x11	C++
 	firefox.exe!CNavDTD::CloseContainersTo(int anIndex=13, nsHTMLTag
aTarget=eHTMLTag_td, int aClosedByStartTag=0)  Line 3362	C++
 	firefox.exe!CNavDTD::CloseContainersTo(nsHTMLTag aTag=eHTMLTag_td, int
aClosedByStartTag=0)  Line 3535 + 0xd	C++
 	firefox.exe!CNavDTD::HandleEndToken(CToken * aToken=0x00000000)  Line 1952	C++
 	firefox.exe!CNavDTD::HandleToken(CToken * aToken=0x00000060, nsIParser *
aParser=0x045adf60)  Line 958 + 0x8	C++
 	firefox.exe!CNavDTD::BuildModel(nsIParser * aParser=0x045adf60, nsITokenizer *
aTokenizer=0x043403c8, nsITokenObserver * anObserver=0x00000000, nsIContentSink
* aSink=0x04f71db8)  Line 458 + 0xa	C++
 	firefox.exe!nsParser::BuildModel()  Line 2116	C++
 	firefox.exe!nsParser::ResumeParse(int allowIteration=1, int aIsFinalChunk=0,
int aCanInterrupt=1)  Line 1978 + 0x6	C++
 	firefox.exe!nsParser::OnDataAvailable(nsIRequest * request=0x04676290,
nsISupports * aContext=0x00000000, nsIInputStream * pIStream=0x0318f5d0,
unsigned int sourceOffset=5602, unsigned int aLength=42745)  Line 2661	C++
 	firefox.exe!nsDocumentOpenInfo::OnDataAvailable(nsIRequest *
request=0x04676290, nsISupports * aCtxt=0x00000000, nsIInputStream *
inStr=0x0318f5d0, unsigned int sourceOffset=5602, unsigned int count=42745) 
Line 374	C++
 	firefox.exe!nsHTTPCompressConv::do_OnDataAvailable(nsIRequest *
request=0x04676290, nsISupports * aContext=0x00000000, unsigned int
aSourceOffset=5602, char * buffer=0x0318f5d0, unsigned int aCount=0)  Line 390
+ 0x17	C++
 	firefox.exe!nsHTTPCompressConv::OnDataAvailable(nsIRequest *
request=0x04676290, nsISupports * aContext=0x00000000, nsIInputStream *
iStr=0x03ed4c48, unsigned int aSourceOffset=5602, unsigned int aCount=25311) 
Line 314	C++
 	firefox.exe!nsStreamListenerTee::OnDataAvailable(nsIRequest *
request=0x04676290, nsISupports * context=0x00000000, nsIInputStream *
input=0x0436bd20, unsigned int offset=5602, unsigned int count=25311)  Line 97
+ 0x1c	C++
 	firefox.exe!nsHttpChannel::OnDataAvailable(nsIRequest * request=0x04714180,
nsISupports * ctxt=0x00000000, nsIInputStream * input=0x0436bd20, unsigned int
offset=5602, unsigned int count=25311)  Line 4152	C++
 	firefox.exe!nsInputStreamPump::OnStateTransfer()  Line 440	C++
 	firefox.exe!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *
stream=0x0436bd20)  Line 341	C++
 	xpcom_core.dll!nsInputStreamReadyEvent::EventHandler(PLEvent *
plevent=0x04ea014c)  Line 120	C++
 	xpcom_core.dll!PL_HandleEvent(PLEvent * self=0x04ea014c)  Line 689	C
 	xpcom_core.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x01c92228)  Line 624	C
 	xpcom_core.dll!_md_TimerProc(HWND__ * hwnd=0x0159038c, unsigned int uMsg=275,
unsigned int idEvent=0, unsigned long dwTime=794219828)  Line 1013 + 0xa	C
 	user32.dll!77d48734() 	
 	user32.dll!77d49857() 	
 	user32.dll!77d49791() 	
 	user32.dll!77d48a10() 	
 	firefox.exe!nsAppShell::Run()  Line 159	C++
 	firefox.exe!nsAppStartup::Run()  Line 146	C++
 	firefox.exe!XRE_main(int argc=86633512, char * * argv=0x0012f77c, const
nsXREAppData * aAppData=0x0012f64c)  Line 2324	C++
 	firefox.exe!main(int argc=1, char * * argv=0x010f8110)  Line 61 + 0x12	C++
 	firefox.exe!mainCRTStartup()  Line 398 + 0x11	C
 	kernel32.dll!7c816d4f() 	
 	kernel32.dll!7c8399f3() 

Comment 2

[Mats Palmgren (inactive)]

Attachment: Testcase

Comment 3

[Mats Palmgren (inactive)]

Attachment: GDB data + stack

Comment 4

[Mats Palmgren (inactive)]

It's a fairly simple logical error, we assign 'mBullet' and then call AddFrames:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/generic/nsBlockFrame.cpp&rev=3.732&root=/cvsroot&mark=7148,7159#7089
this results in trying to make 'mBullet' a prev. sibling to itself! 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/generic/nsBlockFrame.cpp&rev=3.732&root=/cvsroot&mark=5274-5278#5263
(see attached GDB data)

Comment 5

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

This fixes the stack that I have, which is the same as the one in comment 1.
The one in comment 0 is different though, we are coming from InsertFrames
rather than SetInitialChildList, I'm not sure how that can occur for mBullet.
The added assertion should catch it though.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 194408 [details] [diff] [review]
Patch rev. 1

r+sr=bzbarsky; sorry about this.  :(

We need this on the 1.8 branch too.

Comment 7

[Mike Schroepfer]

Bz - can you comment as to why we need this on the branch?  How does this
manifest itself?

Comment 8

[Boris Zbarsky [:bzbarsky]]

It manifests itself as an assertion in debug builds and probably slower code.  I
suspect that there's no obvious way to trigger a crash here, but I wouldn't bet
on it.  And this is a regression, of course.

Comment 9

[Mats Palmgren (inactive)]

Fix for the code path in comment 1 was checked in to trunk at
2005-08-31 12:53 PDT.

I'm leaving the bug open for investigation of the code path in comment 0
(through ContentChanged ... InsertFrames).

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 194408 [details] [diff] [review]
Patch rev. 1

a=dbaron.

I presume this (i.e., everything on this bug from comment 1 to the present, but
not comment 0) is a regression from bug 295947, right?

Comment 11

[Boris Zbarsky [:bzbarsky]]

Yes, indeed.

Comment 12

[Mats Palmgren (inactive)]

Fix for the code path in comment 1 was checked in to MOZILLA_1_8_BRANCH at
2005-08-31 12:53 PDT.

Comment 13

[Hermann Schwab]

*** Bug 301104 has been marked as a duplicate of this bug. ***

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to comment #9)
> I'm leaving the bug open for investigation of the code path in comment 0
> (through ContentChanged ... InsertFrames).

If this bug is fixed, please mark it as such, and file a new bug for the further investigation.

Comment 15

[Jesse Ruderman]

Mats, please file a new bug for the investigation you mentioned in comment 9.

Comment 16

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/afc662d52ab1