255468 - hang with list-style-position: inside and span:after

Status: RESOLVED WORKSFORME

(Core :: Layout: Block and Inline, defect)

Description

[Patrick Reiter Horn]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1

Firefox hangs when using a nested ul with list-style-position: inside when the
contents of li's have a span:after rule.

Reproducible: Always
Steps to Reproduce:
1. Use a page like the test case.
2. From the style sheet menu, change to "Basic Style"
3. Change back to the original style.
4. In some cases, selecting randomly over the list items helps crash it, but in
others, it crashes instantly.
Actual Results:  
Sometimes, it crashes as you click on the style sheet.
Other times, it displays without crashing, but bullet points are instead where
the :after content should be, and everything after the :after content is
missing. In these cases, selecting randomly over these places crashes it.

Expected Results:  
It should display like it originally did before changing stylesheets without
crashing.

Comment 1

[Patrick Reiter Horn]

Attachment: Simple test case with the inline style sheet.

The table is not needed, but seems to make the crash more likely.
It will display correctly at first, but switching to basic layout and back will
crash the browser.

Comment 2

[Patrick Reiter Horn]

Attachment: A backtrace of the crash from gdb.

A backtrace of the crash from gdb.
This is without symbols, so only shows function names.
It looks like recursion in nsPRUint32Key::Clone() and
nsReadingIterator<unsigned short>::advance ().

Comment 3

[Boris Zbarsky [:bzbarsky]]

I get an endless stream of:

###!!! ASSERTION: redo line on totally empty line: 'aState.IsImpactedByFloat()',
file /home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 3461
###!!! ASSERTION: unconstrained height on totally empty line:
'NS_UNCONSTRAINEDSIZE != aState.mAvailSpaceRect.height', file
/home/bzbarsky/mozilla/xlib/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 3463

At the assertion point, "frame" is an nsBulletFrame...

Comment 4

[Boris Zbarsky [:bzbarsky]]

Patrick, for builds without symbols gdb shows completely bogus stacks,
unfortunately.. There isn't a nsPRUint32Key in sight of the code that's causing
problems.

Comment 5

[Mats Palmgren (inactive)]

WFM, SeaMonkey 2005-08-29-02 trunk Linux. In a debug build I see:

###!!! ASSERTION: prev sibling not in line list: 'Not Reached', file
nsBlockFrame.cpp, line 5293

I'm suspecting this could be the same problem as in bug 217903?

Comment 6

[Jesse Ruderman]

WFM, Firefox trunk on Mac.  I see

###!!! ASSERTION: no common ancestor at all???: 'parent', file /Users/jruderman/trunk/mozilla/layout/base/nsLayoutUtils.cpp, line 349

but I see that assertion just about everywhere.

Comment 7

[Jesse Ruderman]

Patrick, I'm marking this bug as WORKSFORME, but please reopen it if you still see it on trunk.

Comment 8

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2a4054d08f34

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/2a4054d08f34