toggling table parts between fixed and inherit crashes

RESOLVED FIXED

Status

()

Core
Layout: Tables
--
critical
RESOLVED FIXED
13 years ago
9 years ago

People

(Reporter: Andrew Schultz, Assigned: Bernd)

Tracking

({crash, testcase})

Trunk
x86
All
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(7 attachments, 1 obsolete attachment)

(Reporter)

Description

13 years ago
With linux trunk 2005021305, toggling various table parts between "fixed" and
"inherit" positioning eventually crashes the browser.
(Reporter)

Comment 1

13 years ago
Created attachment 174271 [details]
testcase

this crashes linux trunk 2005021305.  it generally takes ~100 switches before
the crash
(Reporter)

Comment 2

13 years ago
Created attachment 174272 [details]
stacktrace

Comment 3

13 years ago
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050213
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3685030K
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3684990Z

Stack Signature	 nsHTMLReflowState::CalculateHypotheticalBox
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsHTMLReflowState%3A%3ACalculateHypotheticalBox&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
OS: Linux → All
All the stack shows is that we're trying to work with a deleted frame.

I tested a build from Jan 19, and that crashes too.  So the fact that we go
through WillPaint() here is incidental.

Note that my devel builds also crash, so none of the random crash fixes I have
pending affect this...
(Assignee)

Comment 5

13 years ago
Created attachment 180270 [details]
deterministic crash
(Assignee)

Comment 6

13 years ago
Created attachment 180272 [details]
reduced testcase

if somebody could reduce the testcase even further that would be great.
(Reporter)

Comment 7

13 years ago
Created attachment 180285 [details]
more reduced testcase
(Assignee)

Comment 8

13 years ago
Created attachment 181631 [details]
content vanishing
(Assignee)

Comment 9

13 years ago
Created attachment 181634 [details] [diff] [review]
patch

The patch seems to fix the crash, however it does not fix the vanish testcase
Assignee: nobody → bernd_mozilla
Status: NEW → ASSIGNED
(Assignee)

Comment 10

13 years ago
Created attachment 181637 [details] [diff] [review]
patch rev1

it fixes also the vanish testcase, the problem that this patches addresses is:
one should not permit the creation of pseudoframes and then not process them.
We need to process them there as revert to the old pseudo frame state will
loose them otherwise.
Attachment #181634 - Attachment is obsolete: true
(Assignee)

Updated

13 years ago
Attachment #181637 - Flags: superreview?(bzbarsky)
Attachment #181637 - Flags: review?(bzbarsky)
Comment on attachment 181637 [details] [diff] [review]
patch rev1

r+sr=bzbarsky
Attachment #181637 - Flags: superreview?(bzbarsky)
Attachment #181637 - Flags: superreview+
Attachment #181637 - Flags: review?(bzbarsky)
Attachment #181637 - Flags: review+
(Assignee)

Comment 12

13 years ago
Comment on attachment 181637 [details] [diff] [review]
patch rev1

I did rtest it, the risk is medium, but without the patch we will certainly
loose pseudo frames if we hit this code.
Attachment #181637 - Flags: approval1.8b2?

Comment 13

13 years ago
Comment on attachment 181637 [details] [diff] [review]
patch rev1

a=asa
Attachment #181637 - Flags: approval1.8b2? → approval1.8b2+
(Assignee)

Comment 14

13 years ago
fix checked in
Status: ASSIGNED → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED

Comment 15

9 years ago
layout/tables/crashtests/282175-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.