245300 - We go into an infinite loop when a very tall non-splittable element is in a table

Status: RESOLVED WORKSFORME

(Core :: Layout: Block and Inline, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This bug is spun off from bug 185357 and its testcase #3:
http://bugzilla.mozilla.org/attachment.cgi?id=135617&action=view

We just go into an infinite loop involving PushLines and
PushTruncatedPlaceholderLine. Here's a snapshot of a stack trace:

#0  nsBlockFrame::PushLines(nsBlockReflowState&, nsLineList_iterator)
(this=0x9832644, aState=@0xbff035dc, aLineBefore={mCurrent = 0x9832680,
mListLink = 0x9832680}) at nsBlockFrame.cpp:4179
#1  0x02d2605b in
nsBlockFrame::PushTruncatedPlaceholderLine(nsBlockReflowState&,
nsLineList_iterator, nsIFrame*, int&) (this=0x9832644, aState=@0xbff035dc,
aLine={mCurrent = 0x97ccab8, mListLink = 0x9832680}, aLastPlaceholder=0x0,
aKeepReflowGoing=@0x9832680) at nsBlockFrame.cpp:3333
#2  0x02d27877 in nsBlockFrame::PlaceLine(nsBlockReflowState&, nsLineLayout&,
nsLineList_iterator, int*, int) (this=0x9832644, aState=@0xbff035dc,
aLineLayout=@0x0, aLine={mCurrent = 0x97ccab8, mListLink = 0x9832680},
aKeepReflowGoing=0xbff032e0, aUpdateMaximumWidth=0) at nsBlockFrame.cpp:4082
#3  0x02d26545 in nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&,
nsLineLayout&, nsLineList_iterator, int*, unsigned char*, int, int)
(this=0x9832644, aState=@0xbff035dc, aLineLayout=@0xbff02cec, aLine={mCurrent =
0x97ccab8, mListLink = 0x9832680}, aKeepReflowGoing=0xbff032e0,
aLineReflowStatus=0x9832680 "�\t�\t�\t", aUpdateMaximumWidth=0,
aDamageDirtyArea=1) at nsBlockFrame.cpp:3498
#4  0x02d25fef in nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState&,
nsLineList_iterator, int*, unsigned char*, int, int) (this=0x9832644,
aState=@0xbff035dc, aLine={mCurrent = 0x97ccab8, mListLink = 0x9832680},
aKeepReflowGoing=0xbff032e0, aLineReflowStatus=0xbff03193 "\0021",
aUpdateMaximumWidth=0, aDamageDirtyArea=1) at nsBlockFrame.cpp:3312
#5  0x02d25e40 in nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,
nsLineList_iterator, int*, int, int) (this=0x9832644, aState=@0xbff035dc,
aLine={mCurrent = 0x97ccab8, mListLink = 0x9832680},
aKeepReflowGoing=0xbff032e0, aDamageDirtyArea=1, aUpdateMaximumWidth=0) at
nsBlockFrame.cpp:3256
#6  0x02d246ff in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x9832644, aState=@0xbff035dc,
aLine={mCurrent = 0x97ccab8, mListLink = 0x9832680},
aKeepReflowGoing=0xbff032e0, aDamageDirtyArea=1) at nsBlockFrame.cpp:2426
#7  0x02d23a03 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x9832644, aState=@0xbff035dc) at nsBlockFrame.cpp:2085
#8  0x02d213d9 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x9832644, aPresContext=0x97bd928,
aMetrics=@0xbff039dc, aReflowState=@0xbff0391c, aStatus=@0xbff03b7c) at
nsBlockFrame.cpp:812
#9  0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x98325e4, aKidFrame=0x9832644, aPresContext=0x97bd928,
aDesiredSize=@0xbff039dc, aReflowState=@0xbff0391c, aX=15, aY=15, aFlags=0,
aStatus=@0xbff03b7c) at nsContainerFrame.cpp:966
#10 0x02e0d84d in nsTableCellFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x98325e4,
aPresContext=0x97bd928, aDesiredSize=@0xbff03c7c, aReflowState=@0xbff03b9c,
aStatus=@0xbff03b7c) at nsTableCellFrame.cpp:860
#11 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x983258c, aKidFrame=0x98325e4, aPresContext=0x97bd928,
aDesiredSize=@0xbff03c7c, aReflowState=@0xbff03b9c, aX=0, aY=0, aFlags=0,
aStatus=@0xbff03b7c) at nsContainerFrame.cpp:966
#12 0x02e26e70 in nsTableRowFrame::ReflowChildren(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, nsTableFrame&, unsigned&, int)
(this=0x983258c, aPresContext=0x97bd928, aDesiredSize=@0xbff03e6c,
aReflowState=@0xbff03ebc, aTableFrame=@0x9832724, aStatus=@0xbff049c8,
aDirtyOnly=0) at nsTableRowFrame.cpp:956
#13 0x02e27d78 in nsTableRowFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x983258c, aPresContext=0x97bd928,
aDesiredSize=@0xbff03e6c, aReflowState=@0xbff03ebc, aStatus=@0xbff049c8) at
nsTableRowFrame.cpp:1394
#14 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x9832698, aKidFrame=0x983258c, aPresContext=0x97bd928,
aDesiredSize=@0xbff03e6c, aReflowState=@0xbff03ebc, aX=0, aY=0, aFlags=3,
aStatus=@0xbff049c8) at nsContainerFrame.cpp:966
#15 0x02e2a505 in nsTableRowGroupFrame::SplitRowGroup(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, nsTableFrame*, unsigned&)
(this=0x9832698, aPresContext=0x97bd928, aDesiredSize=@0xbff042dc,
aReflowState=@0xbff0421c, aTableFrame=0x9832724, aStatus=@0xbff049c8) at
nsTableRowGroupFrame.cpp:1017
#16 0x02e2ac09 in nsTableRowGroupFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x9832698,
aPresContext=0x97bd928, aDesiredSize=@0xbff042dc, aReflowState=@0xbff0421c,
aStatus=@0xbff049c8) at nsTableRowGroupFrame.cpp:1255
#17 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x9832724, aKidFrame=0x9832698, aPresContext=0x97bd928,
aDesiredSize=@0xbff042dc, aReflowState=@0xbff0421c, aX=30, aY=30, aFlags=0,
aStatus=@0xbff049c8) at nsContainerFrame.cpp:966
#18 0x02e16209 in nsTableFrame::ReflowChildren(nsIPresContext*,
nsTableReflowState&, int, int, unsigned&, nsIFrame*&, nsRect&, int*)
(this=0x9832724, aPresContext=0x97bd928, aReflowState=@0xbff043dc,
aDoColGroups=1, aDirtyOnly=0, aStatus=@0xbff049c8,
aLastChildReflowed=@0xbff0447c, aOverflowArea=@0xbff04800,
aReflowedAtLeastOne=0x0) at nsTableFrame.cpp:3229
#19 0x02e14077 in nsTableFrame::ReflowTable(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, nsReflowReason, nsIFrame*&,
int&, unsigned&) (this=0x9832724, aPresContext=0x97bd928,
aDesiredSize=@0xbff047cc, aReflowState=@0xbff045ac, aAvailHeight=14400,
aReason=eReflowReason_Initial, aLastChildReflowed=@0xbff0447c,
aDidBalance=@0xbff043dc, aStatus=@0xbff049c8) at nsTableFrame.cpp:2151
#20 0x02e13b3c in nsTableFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x9832724, aPresContext=0x97bd928,
aDesiredSize=@0xbff047cc, aReflowState=@0xbff045ac, aStatus=@0xbff049c8) at
nsTableFrame.cpp:1994
#21 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x98326d8, aKidFrame=0x9832724, aPresContext=0x97bd928,
aDesiredSize=@0xbff047cc, aReflowState=@0xbff045ac, aX=0, aY=0, aFlags=3,
aStatus=@0xbff049c8) at nsContainerFrame.cpp:966
#22 0x02e22e3e in nsTableOuterFrame::OuterReflowChild(nsIPresContext*,
nsIFrame*, nsHTMLReflowState const&, nsHTMLReflowMetrics&, int, nsSize&,
nsMargin&, nsMargin&, nsMargin&, nsReflowReason, unsigned&, int*)
(this=0x98326d8, aPresContext=0x97bd928, aChildFrame=0x9832724,
aOuterRS=@0xbff04a9c, aMetrics=@0xbff047cc, aAvailWidth=10560,
aDesiredSize=@0xbff0478c, aMargin=@0xbff0479c, aMarginNoAuto=@0xbff047ac,
aPadding=@0xbff045ac, aReflowReason=eReflowReason_Initial, aStatus=@0xbff049c8,
aNeedToReflowCaption=0x0) at nsTableOuterFrame.cpp:1331
#23 0x02e24a8a in nsTableOuterFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x98326d8,
aPresContext=0x97bd928, aDesiredSize=@0xbff04ba0, aOuterRS=@0xbff04a9c,
aStatus=@0xbff049c8) at nsTableOuterFrame.cpp:1995
#24 0x02d303d3 in nsBlockReflowContext::ReflowBlock(nsRect const&, int,
nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&)
(this=0xbff04b5c, aSpace=@0x9832680, aApplyTopMargin=0,
aPrevBottomMargin=@0xbff050b0, aIsAdjacentWithTop=1,
aComputedOffsets=@0xbff04a8c, aFrameRS=@0xbff04a9c,
aFrameReflowStatus=@0xbff049c8) at nsBlockReflowContext.cpp:546
#25 0x02d2578a in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, int*) (this=0x98327dc, aState=@0xbff0504c, aLine={mCurrent
= 0x98327ac, mListLink = 0x9832818}, aKeepReflowGoing=0xbff04d50) at
nsBlockFrame.cpp:3034
#26 0x02d2435d in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x98327dc, aState=@0xbff0504c,
aLine={mCurrent = 0x98327ac, mListLink = 0x9832818},
aKeepReflowGoing=0xbff04d50, aDamageDirtyArea=0) at nsBlockFrame.cpp:2300
#27 0x02d23a03 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x98327dc, aState=@0xbff0504c) at nsBlockFrame.cpp:2085
#28 0x02d213d9 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x98327dc, aPresContext=0x97bd928,
aMetrics=@0xbff05540, aReflowState=@0xbff0543c, aStatus=@0xbff05368) at
nsBlockFrame.cpp:812
#29 0x02d303d3 in nsBlockReflowContext::ReflowBlock(nsRect const&, int,
nsCollapsingMargin&, int, nsMargin&, nsHTMLReflowState&, unsigned&)
(this=0xbff054fc, aSpace=@0x9832680, aApplyTopMargin=0,
aPrevBottomMargin=@0xbff05a50, aIsAdjacentWithTop=1,
aComputedOffsets=@0xbff0542c, aFrameRS=@0xbff0543c,
aFrameReflowStatus=@0xbff05368) at nsBlockReflowContext.cpp:546
#30 0x02d2578a in nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&,
nsLineList_iterator, int*) (this=0x9832920, aState=@0xbff059ec, aLine={mCurrent
= 0x9832830, mListLink = 0x983295c}, aKeepReflowGoing=0xbff056f0) at
nsBlockFrame.cpp:3034
#31 0x02d2435d in nsBlockFrame::ReflowLine(nsBlockReflowState&,
nsLineList_iterator, int*, int) (this=0x9832920, aState=@0xbff059ec,
aLine={mCurrent = 0x9832830, mListLink = 0x983295c},
aKeepReflowGoing=0xbff056f0, aDamageDirtyArea=0) at nsBlockFrame.cpp:2300
#32 0x02d23a03 in nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&)
(this=0x9832920, aState=@0xbff059ec) at nsBlockFrame.cpp:2085
#33 0x02d213d9 in nsBlockFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x9832920, aPresContext=0x97bd928,
aMetrics=@0xbff062ac, aReflowState=@0xbff05cec, aStatus=@0xbff060f4) at
nsBlockFrame.cpp:812
#34 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x98328cc, aKidFrame=0x9832920, aPresContext=0x97bd928,
aDesiredSize=@0xbff062ac, aReflowState=@0xbff05cec, aX=0, aY=0, aFlags=0,
aStatus=@0xbff060f4) at nsContainerFrame.cpp:966
#35 0x02d80e75 in nsPageContentFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x98328cc,
aPresContext=0x97bd928, aDesiredSize=@0xbff062ac, aReflowState=@0xbff05eec,
aStatus=@0xbff060f4) at nsPageContentFrame.cpp:95
#36 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x9832860, aKidFrame=0x98328cc, aPresContext=0x97bd928,
aDesiredSize=@0xbff062ac, aReflowState=@0xbff05eec, aX=1080, aY=1080, aFlags=0,
aStatus=@0xbff060f4) at nsContainerFrame.cpp:966
#37 0x02d7eff8 in nsPageFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x9832860, aPresContext=0x97bd928,
aDesiredSize=@0xbff062ac, aReflowState=@0xbff061bc, aStatus=@0xbff060f4) at
nsPageFrame.cpp:210
#38 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x92f3d04, aKidFrame=0x9832860, aPresContext=0x97bd928,
aDesiredSize=@0xbff062ac, aReflowState=@0xbff061bc, aX=360, aY=4567980,
aFlags=0, aStatus=@0xbff060f4) at nsContainerFrame.cpp:966
#39 0x02d9ace9 in nsSimplePageSequenceFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x92f3d04,
aPresContext=0x97bd928, aDesiredSize=@0xbff065dc, aReflowState=@0xbff0647c,
aStatus=@0xbff065c8) at nsSimplePageSequence.cpp:420
#40 0x02e3a0e8 in nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState&,
nsIPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&, int,
int, int, int, int) (this=0x97cac80, aState=@0xbff06acc, aPresContext=0x97bd928,
aDesiredSize=@0xbff065dc, aReflowState=@0xbff06c4c, aStatus=@0xbff065c8, aX=0,
aY=0, aWidth=12240, aHeight=15840, aMoveFrame=1) at nsBoxToBlockAdaptor.cpp:878
#41 0x02e39baa in nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState&)
(this=0x97cac80, aState=@0xbff06acc) at nsBoxToBlockAdaptor.cpp:625
#42 0x02e32795 in nsBox::Layout(nsBoxLayoutState&) (this=0x97cac80,
aState=@0xbff06acc) at nsBox.cpp:992
#43 0x02e2e94f in nsScrollBoxFrame::DoLayout(nsBoxLayoutState&) (this=0x92f4018,
aState=@0xbff06acc) at nsScrollBoxFrame.cpp:335
#44 0x02e32795 in nsBox::Layout(nsBoxLayoutState&) (this=0x92f4050,
aState=@0xbff06acc) at nsBox.cpp:992
#45 0x02e3bb58 in nsContainerBox::LayoutChildAt(nsBoxLayoutState&, nsIBox*,
nsRect const&) (aState=@0xbff06acc, aBox=0x92f4050, aRect=@0xbff069bc) at
nsContainerBox.cpp:650
#46 0x02d4fd3f in nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState&, nsIBox*,
nsRect const&) (this=0x92f3f70, aState=@0xbff06acc, aBox=0x92f4050,
aRect=@0xbff069bc) at nsGfxScrollFrame.cpp:1128
#47 0x02d4ffb4 in nsGfxScrollFrameInner::Layout(nsBoxLayoutState&)
(this=0x92f3f70, aState=@0xbff06acc) at nsGfxScrollFrame.cpp:1281
#48 0x02d4fd7f in nsGfxScrollFrame::DoLayout(nsBoxLayoutState&) (this=0x92f3ed8,
aState=@0xbff06acc) at nsGfxScrollFrame.cpp:1136
#49 0x02e32795 in nsBox::Layout(nsBoxLayoutState&) (this=0x92f3f10,
aState=@0xbff06acc) at nsBox.cpp:992
#50 0x02e3577c in nsBoxFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x92f3ed8, aPresContext=0x92f3f10,
aDesiredSize=@0xbff06d1c, aReflowState=@0xbff06c4c, aStatus=@0xbff06df8) at
nsBoxFrame.cpp:864
#51 0x02d4e65d in nsGfxScrollFrame::Reflow(nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned&) (this=0x92f3ed8,
aPresContext=0x97bd928, aDesiredSize=@0xbff06d1c, aReflowState=@0xbff06c4c,
aStatus=@0xbff06df8) at nsGfxScrollFrame.cpp:536
#52 0x02d3840a in nsContainerFrame::ReflowChild(nsIFrame*, nsIPresContext*,
nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned, unsigned&)
(this=0x92f3bfc, aKidFrame=0x92f3ed8, aPresContext=0x97bd928,
aDesiredSize=@0xbff06d1c, aReflowState=@0xbff06c4c, aX=0, aY=0, aFlags=0,
aStatus=@0xbff06df8) at nsContainerFrame.cpp:966
#53 0x02dacbfe in ViewportFrame::Reflow(nsIPresContext*, nsHTMLReflowMetrics&,
nsHTMLReflowState const&, unsigned&) (this=0x92f3bfc, aPresContext=0x97bd928,
aDesiredSize=@0xbff06ecc, aReflowState=@0xbff06e0c, aStatus=@0xbff06df8) at
nsViewportFrame.cpp:247
#54 0x02d87100 in PresShell::InitialReflow(int, int) (this=0x97ac2a8,
aWidth=12240, aHeight=15840) at nsPresShell.cpp:2903
#55 0x02e9ab42 in nsPrintEngine::ReflowPrintObject(nsPrintObject*, int)
(this=0x97ab4a8, aPO=0x97ab860, aDoCalcShrink=1) at nsPrintEngine.cpp:2782
#56 0x02e99d0b in nsPrintEngine::ReflowDocList(nsPrintObject*, int, int)
(this=0x97ab4a8, aPO=0x97ab860, aSetPixelScale=0, aDoCalcShrink=1) at
nsPrintEngine.cpp:2540
#57 0x02e996b8 in nsPrintEngine::SetupToPrintContent(nsIDeviceContext*,
nsIDOMWindow*) (this=0x97ab4a8, aDContext=0x9832680, aCurrentFocusedDOMWin=0x0)
at nsPrintEngine.cpp:2349
#58 0x02e98a0f in nsPrintEngine::DocumentReadyForPrinting() (this=0x97ab4a8) at
nsPrintEngine.cpp:2165
#59 0x02e9e6ec in nsPrintEngine::FinishPrintPreview() (this=0x97ab4a8) at
nsPrintEngine.cpp:4461
#60 0x02e96124 in nsPrintEngine::PrintPreview(nsIPrintSettings*, nsIDOMWindow*,
nsIWebProgressListener*) (this=0x97ab4a8, aPrintSettings=0x96ae798,
aChildDOMWin=0x0, aWebProgressListener=0x978a6e4) at nsPrintEngine.cpp:1251
#61 0x02ecfc10 in DocumentViewerImpl::PrintPreview(nsIPrintSettings*,
nsIDOMWindow*, nsIWebProgressListener*) (this=0x9748660,
aPrintSettings=0x96ae798, aChildDOMWin=0x0, aWebProgressListener=0x978a6e4) at
nsDocumentViewer.cpp:3135
#62 0x00584c27 in XPTC_InvokeByIndex () at nsWeakReference.cpp:47
#63 0x003193f9 in XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode) (ccx=@0xbff07710, mode=CALL_METHOD) at
xpcwrappednative.cpp:2026
#64 0x00321332 in XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*,
long*) (cx=0x92eb738, obj=0xbd147478, argc=3, argv=0xbff07710, vp=0xbff07850) at
xpcwrappednativejsops.cpp:1287
#65 0x009eb993 in js_Invoke (cx=0x92eb738, argc=3, flags=0) at jsinterp.c:1281
#66 0x009f685d in js_Interpret (cx=0x92eb738, result=0xbff07acc) at jsinterp.c:3370
#67 0x009eb9f6 in js_Invoke (cx=0x92eb738, argc=1, flags=2) at jsinterp.c:1301
#68 0x009ebc5f in js_InternalInvoke (cx=0x92eb738, obj=0x9832680,
fval=159590016, flags=0, argc=1, argv=0x97b90e8, rval=0x9832680) at jsinterp.c:1378
#69 0x009c7d1e in JS_CallFunctionValue (cx=0x92eb738, obj=0x91bc2a8,
fval=156069368, argc=1, argv=0x97b90e8, rval=0xbff07cf8) at jsapi.c:3631
#70 0x030b146b in nsJSContext::CallEventHandler(JSObject*, JSObject*, unsigned,
long*, long*) (this=0x91f6390, aTarget=0x91bc2a8, aHandler=0x94d6df8, argc=1,
argv=0x97b90e8, rval=0xbff07cf8) at nsJSEnvironment.cpp:1263
#71 0x030c4ba7 in GlobalWindowImpl::RunTimeout(nsTimeoutImpl*) (this=0x92eb588,
aTimeout=0x97ab008) at nsGlobalWindow.cpp:5014
#72 0x030c5444 in GlobalWindowImpl::TimerCallback(nsITimer*, void*)
(aTimer=0x948fee8, aClosure=0x97ab008) at nsGlobalWindow.cpp:5375
#73 0x00565db4 in nsTimerImpl::Fire() (this=0x948fee8) at nsTimerImpl.cpp:383
#74 0x00565f35 in handleTimerEvent(TimerEventType*) (event=0x92f8a18) at
nsTimerImpl.cpp:448
#75 0x0055f422 in PL_HandleEvent (self=0x92f8a18) at plevent.c:692
#76 0x0055f2fb in PL_ProcessPendingEvents (self=0x91b26b0) at plevent.c:627
#77 0x00561caa in nsEventQueueImpl::ProcessPendingEvents() (this=0x91cb378) at
nsEventQueue.cpp:391
#78 0x00e4f5c6 in event_processor_callback (source=0x93afcd0, condition=G_IO_IN,
data=0x9832680) at nsAppShell.cpp:67
#79 0x00226ccf in g_vsnprintf () from /usr/lib/libglib-2.0.so.0
#80 0x00205fdd in unblock_source () from /usr/lib/libglib-2.0.so.0
#81 0x00206fd8 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#82 0x002072ef in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#83 0x002079cf in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#84 0x05d1a44f in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The reflow log I saw was (not sure whether this was testcase 2 or testcase 3 on
the bug in question -- I think 2):

The infinite loop on testcase #2 is:

   page 0x91905b8 r=0 a=13008,16608 c=13008,UC pif=0x91901d0 cnt=687
    PageContent(-1) 0x9190624 r=0 a=10800,14400 c=10800,UC cnt=688
     area 0x9190678 r=0 a=10800,14400 c=10800,UC pif=0x9190290 cnt=689
      block 0x9190534 r=0 a=10800,14400 c=10608,UC pif=0x919014c cnt=690
       tblO 0x9190430 r=0 a=10608,14400 c=0,UC pif=0x9190048 cnt=691
        tbl 0x919047c r=0 a=10608,14400 c=UC,UC pif=0x9190094 cnt=692
         rowG 0x91903f0 r=0 a=192,14352 c=192,UC pif=0x9190008 cnt=693
          row 0x91902e4 r=0 a=192,UC c=192,UC pif=0x918fefc cnt=694
           cell 0x919033c r=0 a=192,UC c=168,UC pif=0x918ff54 cnt=695
            block 0x919039c r=0 a=168,UC c=168,UC pif=0x918ffb4 cnt=696
###!!! ASSERTION: SetParent failed!: 'NS_SUCCEEDED(rv)', file
/builds/1.7/mozilla/view/src/nsViewManager.cpp, line 2375
Break: at file /builds/1.7/mozilla/view/src/nsViewManager.cpp, line 2375
             text 0x917e4a0 r=2 a=168,UC c=UC,UC cnt=697
             text 0x917e4a0 d=102,188
             place 0x917e780 r=2 a=66,UC c=UC,UC cnt=698
             place 0x917e780 d=0,0
             subdoc 0x917e6f4 r=2 a=168,UC c=120,24000 cnt=699
             subdoc 0x917e6f4 d=168,24048
            block 0x919039c d=168,24252
           cell 0x919033c d=192,24276
          row 0x91902e4 d=192,24276
          row 0x91902e4 r=2 a=192,14352 c=192,UC pif=0x918fefc cnt=700
           cell 0x919033c r=2 a=192,14352 c=168,UC pif=0x918ff54 cnt=701
            block 0x919039c r=2 a=168,14328 c=168,UC pif=0x918ffb4 cnt=702
             text 0x917e4a0 r=2 a=168,14328 c=UC,UC cnt=703
             text 0x917e4a0 d=102,188
             place 0x917e780 r=2 a=66,14328 c=UC,UC cnt=704
             place 0x917e780 d=0,0
             subdoc 0x917e6f4 r=2 a=168,14124 c=120,24000 cnt=705
             subdoc 0x917e6f4 d=168,24048
            block 0x919039c d=168,24252 status=0x1
           cell 0x919033c d=192,24276 status=0x1
          row 0x91902e4 d=192,24276 status=0x1
###!!! ASSERTION: data loss - incomplete row needed more height than available,
on top of page: 'rowMetrics.height <= rowReflowState.availableHeight', file
/builds/1.7/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp, line 1101
Break: at file
/builds/1.7/mozilla/layout/html/table/src/nsTableRowGroupFrame.cpp, line 1101
         rowG 0x91903f0 d=192,24276 status=0x1
        tbl 0x919047c d=240,24324 status=0x1
       tblO 0x9190430 d=240,24324 status=0x1
      block 0x9190534 d=10608,24324 status=0x1
     area 0x9190678 d=10800,24324 status=0x1
    PageContent(-1) 0x9190624 d=10800,14400 status=0x1
   page 0x91905b8 d=13008,16608 status=0x1
###!!! ASSERTION: aContent1 must not be null: 'aContent1', file
/builds/1.7/mozilla/layout/base/src/nsLayoutUtils.cpp, line 222
Break: at file /builds/1.7/mozilla/layout/base/src/nsLayoutUtils.cpp, line 222
[repeated many times]

Comment 2

[Bernd]

This is just an incarnation of bug 113217. The subdoc frame does not paginate.
See in the reflow log that all frames upstream the subdoc have a
previousInFlow(pif). So what happens is that on the first reflow the subdoc
reports a height significant larger than allowed to be paced on the page. The
block inside the table cell paginates, is marked as incomplete and as
consequence all frames above that do the same. Then we are on the second page as
the subdoc does not paginate it still reports the same too large for one page
height. The block frame around it assumes that another page will give finally
the damned frame enough space and so it loops forever.

Comment 3

[Bernd]

While the core problem is of course bug 113217, the block code adds another
layer to it. If one removes the text before the iframe
<td>y<iframe width="10" height="2000" align="right"></iframe></td>
this testcase stops to loop infinite. It shows still bug 113217, which makes me
believe that the testcase should be handled different:
first page the text before the iframe
second page the iframe and then the loop will not appear.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(In reply to comment #3)
> While the core problem is of course bug 113217, the block code adds another
> layer to it. If one removes the text before the iframe
> <td>y<iframe width="10" height="2000" align="right"></iframe></td>
> this testcase stops to loop infinite. It shows still bug 113217, which makes me
> believe that the testcase should be handled different:
> first page the text before the iframe
> second page the iframe and then the loop will not appear.

Right. That's what you should get if you remove the table; two pages of output
and then we're done. Why doesn't that happen when it's in a table?

Comment 5

[Bernd]

Attachment: reflow loop with y before the iframe

Comment 6

[Bernd]

Attachment: no loop without y before iframe

Comment 7

[Bernd]

The most interesting difference happens when the cell is reflowed the third time
with only the available height:

without y we have

          row 03779588 r=2 a=192,14592 c=192,UC cnt=265 
           cell 03779734 r=2 a=192,14592 c=168,UC cnt=266 
            block 03779794 r=2 a=168,14568 c=168,UC cnt=267 
             place 03779AEC r=2 a=168,14568 c=UC,UC cnt=268 
             place 03779AEC d=0,0 me=0 
             subdoc 037799CC r=2 a=168,14568 c=120,24000 cnt=269 
             subdoc 037799CC d=168,24048 me=168 
            block 03779794 d=168,24048 me=168 
           cell 03779734 d=192,24072 me=192 
          row 03779588 d=192,24072 

the block just places the iframe and thats it.

in the loop case the block reports incompleteness
row 047CCB20 r=2 a=192,14592 c=192,UC cnt=265 
           cell 047CCCCC r=2 a=192,14592 c=168,UC cnt=266 
            block 047CCD2C r=2 a=168,14568 c=168,UC cnt=267 
             text 047CCE78 r=2 a=168,14568 c=UC,UC cnt=268 
             text 047CCE78 d=91,216 me=91 
             place 047CD114 r=2 a=77,14568 c=UC,UC cnt=269 
             place 047CD114 d=0,0 me=0 
             subdoc 047CCFF4 r=2 a=168,14345 c=120,24000 cnt=270 
             subdoc 047CCFF4 d=168,24048 me=168 
            block 047CCD2C d=168,223 me=168 status=0x3
           cell 047CCCCC d=192,240 me=192 status=0x3
          row 047CCB20 d=192,240 status=0x1
which looks like just the height of the text frame. On the next page however one
would not expect to see the same textframe again:

          cell 04809A24 r=0 a=192,UC c=168,UC pif=047CCCCC cnt=281 
            block 04809A84 r=0 a=168,UC c=168,UC pif=047CCD2C cnt=282 
             text 047CCE78 r=2 a=168,UC c=UC,UC cnt=283  <--???????
             text 047CCE78 d=91,216 me=91 
             place 047CD114 r=2 a=77,UC c=UC,UC cnt=284 
             place 047CD114 d=0,0 me=0 
             subdoc 047CCFF4 r=2 a=168,UC c=120,24000 cnt=285 
             subdoc 047CCFF4 d=168,24048 me=168 
            block 04809A84 d=168,24271 me=168 
           cell 04809A24 d=192,24300 me=192 

so the block did not only push the iframe but also the text. And then block is
to large, gets a smaller height, the block sees that it could split after the
text pushes it again and so we loop

Comment 8

[Bernd]

Attachment: tableless testcase (hang in preview)

Comment 9

[Bernd]

Attachment: more reduced testcase

>Right. That's what you should get if you remove the table; two pages of output

>and then we're done. Why doesn't that happen when it's in a table?
But you dont get even if the table is removed

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Thanks bernd,

The current code is supposed to see that the IFRAME doesn't fit, and then split
the line after the "y" to push the IFRAME to the next page. That isn't working
right.

Probably a better idea is that if the float doesn't fit vertically, but it's on
the first line of the block, then instead of splitting, just request the entire
block be pushed to the next page --- just as we would if it was a regular first
line that didn't fit. Those requests get cascaded up the tree until we reach the
page frame, which decides to ignore them since pushing everything to the next
page won't help at all.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(In reply to comment #10)
> Probably a better idea is that if the float doesn't fit vertically, but it's
> on the first line of the block, then instead of splitting, just request the
> entire block be pushed to the next page --- just as we would if it was a regular
> first line that didn't fit. Those requests get cascaded up the tree until we
> reach the page frame, which decides to ignore them since pushing everything to
> the next page won't help at all.

That can't work when the IFRAME placeholder follows text on the line, as it does
in this testcase, because we always place right-floats on the line after their
placeholder whenever the placeholder is not at the extreme left of the line.

Comment 12

[Robert O'Callahan (:roc) (email my personal email if necessary)]

The reason this is failing is that if nsBlockFrame::PlaceLine calls
nsBlockReflowState::PlaceBelowCurrentLineFloats and gets a result of PR_FALSE,
i.e. at least one float was truncated (did not fit entirely onto the page and
was not at top of page), it pushes *the entire line* to the next page. This is
overkill. It should break the line before the placeholder, and just push the
placeholder and what follows to the next line.

Comment 13

[Robert O'Callahan (:roc) (email my personal email if necessary)]

That would be tricky to implement though; by the time we get to placing the
below-current-line floats, we're done reflowing the line. And if we push the
placeholder and following frames out and reflow the line again, it will just
pull the placeholder and following frames back.

Maybe what we should do is leave the line alone and push just the floats to the
next page. The placeholders in the line will effectively have no float attached
to them. Their continuations will get all the float content.

I might leave this bug until after I've eliminated placeholder continuations.

Comment 14

[Martijn Wargers (dead)]

Both testcases don't cause a hang anymore on print preview in the 20050323 build
for me. It did hang for me with a 20050318 trunk build, so most likely fixed by
bug 263825, I think.