274342 - Crash styling mozilla.org homepage with column-width:200px [@ nsLineBox::IsEmpty]

Status: VERIFIED FIXED

(Core :: Layout: Block and Inline, defect)

Description

[Christian :Biesinger (don't email me, ping me on IRC)]

trying to style mozilla.org with 200px wide columns crashes (note that 50px
columns work). before that, I get lots of assertions (see below)

steps to reproduce:
1. load http://www.mozilla.org
2. load javascript:void(document.body.style.MozColumnWidth='200px')

See attachments for the assertions I get and the stack.

note that the assertions also contain assertions for setting column-width to
50px; sorry about that.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: Assertions

Summary:
- lots of:
###!!! ASSERTION: bad state: 'aState.mContentArea.width >=
aState.mAvailSpaceRect.XMost()', file
/home/chb/mozilla/layout/generic/nsBlockFrame.cpp, line 4317
- a few:
###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file
/home/chb/mozilla/layout/generic/nsBlockFrame.cpp, line 5402
- many:
###!!! ASSERTION: can't find deleted frame in lines: 'Error', file
/home/chb/mozilla/layout/generic/nsBlockFrame.cpp, line 5255

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: stack trace

Summary:
0x418f147a in nsLineBox::IsEmpty (this=0x871d6d4) at
/home/chb/mozilla/layout/generic/nsLineBox.cpp:286
286	    if (!kid->IsEmpty())
(gdb) bt
#0  0x418f147a in nsLineBox::IsEmpty (this=0x871d6d4) at
/home/chb/mozilla/layout/generic/nsLineBox.cpp:286
#1  0x418f1520 in nsLineBox::CachedIsEmpty (this=0x871d6d4) at
/home/chb/mozilla/layout/generic/nsLineBox.cpp:303
#2  0x4189f024 in nsBlockFrame::PlaceLine (this=0x86b5d3c, aState=@0xbfffb380,
aLineLayout=@0xbfffadf0, aLine=
      {mCurrent = 0x871d6d4, mListLink = 0x86b5d78},
aKeepReflowGoing=0xbfffb158, aUpdateMaximumWidth=0)


(gdb) print kid
$1 = (class nsIFrame *) 0x0

Comment 3

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: stacktrace with local variables

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

this may also be of interest:
(gdb) print mFirstChild
$2 = (class nsIFrame *) 0x8720160
(gdb) print GetChildCount()
$3 = 2
(gdb) print mFirstChild->GetNextSibling()
$4 = (nsIFrame *) 0x0


I was using current cvs seamonkey trunk, gtk1, when crashing.

Comment 5

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a6) Gecko/20041212
It doesn´t crash, but height is reduced, values seen in DOM-Inspector.

Screen resolution 800x600, original width 742 px, original height 813 px reduced
to 578 px, doesn´t matter if styled to 200 or 50 px.

Comment 6

[Andrew Schultz]

Attachment: testcase

loading this testcase crashes linux trunk 2004121205

Comment 7

[Andrew Schultz]

Attachment: even simpler testcase

<div style="height: 100px; float: left;"></div>
  <div style="height: 50px;"></div>
  <script>document.body.style.MozColumnWidth='200px';</script>

Comment 8

[Hermann Schwab]

(In reply to comment #7)
> Created an attachment (id=168593) [edit]
> even simpler testcase

regressed on windows between BuildID 2004100707 and 2004100806
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=Bug+274342&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041007-05 ok
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041007-07 Firefox/0.9.1+ ok
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041008-06
Firefox/0.9.1+ crash
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041009-06
Firefox/0.9.1+ crash
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041011-07 crash

Comment 9

[Andrew Schultz]

> regressed on windows between BuildID 2004100707 and 2004100806

that's just the landing of CSS3 column support (bug 251162).  it's not really a
regression.

Comment 10

[Martijn Wargers (dead)]

This could be similar to bug 263825.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Fixed by the checkin for bug 263825. I wouldn't say the results are pleasing,
but we don't crash :-).

Comment 12

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED with https://bugzilla.mozilla.org/attachment.cgi?id=168593 and
https://bugzilla.mozilla.org/attachment.cgi?id=168592 using build 2005-03-23-05
on Windows XP Seamonkey trunk.