Closed Bug 286491 Opened 17 years ago Closed 16 years ago

Crash [@ nsLineLayout::ReflowFrame] with evil testcase with iframe and flash inside it

Categories

(Core :: Layout: Block and Inline, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: roc)

References

Details

(4 keywords)

Crash Data

Attachments

(2 files)

The title sucks, but I couldn't think of a better one, I'm afraid.

The testcase is still a bit complicated.
You should have flash installed to get the crash.
I think I've reduced the testcase as far as it goes.

Talkback ID: TB4396728E

0x00000000
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 1144]
nsInlineFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 712]
nsInlineFrame::ReflowFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 530]
nsInlineFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsInlineFrame.cpp,
line 444]
nsLineLayout::ReflowFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsLineLayout.cpp,
line 999]
nsBlockFrame::ReflowInlineFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 4109]
nsBlockFrame::DoReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3799]
nsBlockFrame::ReflowInlineFrames 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3688]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2723]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 827]
nsBlockReflowContext::ReflowBlock 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockReflowContext.cpp,
line 547]
nsBlockFrame::ReflowBlockFrame 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 3417]
nsBlockFrame::ReflowLine 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2604]
nsBlockFrame::ReflowDirtyLines 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 2234]
nsBlockFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsBlockFrame.cpp,
line 827]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 954]
CanvasFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsHTMLFrame.cpp,
line 522]
nsFrame::BoxReflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5361]
nsFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsFrame.cpp,
line 5103]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsGfxScrollFrameInner::LayoutBox 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 1624]
nsHTMLScrollFrame::DoLayout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 560]
nsIFrame::Layout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsBox.cpp,
line 802]
nsHTMLScrollFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsGfxScrollFrame.cpp,
line 488]
nsContainerFrame::ReflowChild 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsContainerFrame.cpp,
line 954]
ViewportFrame::Reflow 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/generic/nsViewportFrame.cpp,
line 240]
IncrementalReflow::Dispatch 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 907]
PresShell::ProcessReflowCommands 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6435]
ReflowEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6261]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/plevent.c,
line 699]
SHELL32.dll + 0x520c24 (0x778b0c24)
Attached file Testcase
To trigger the crash:
- Hover first over link2, then hover over link1.

The button 'doe()' shows maybe something interesting. After clicking button
doe(), both links should be on the same line, since after they've gone through
display:block, the get back to their default style, which is display:inline.
That's not what they are doing.
If you repeat function doe() every 20ms, you soon hit some frame corruption and
Mozilla becomes unusable.
It seems like a regression.
The crashing/freezing doesn't happen with 2005-02-22 07:26am build.
But the crashing/freezing happens with 2005-02-23 07:24am build.
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-22+07%3A00%3A00&maxdate=2005-02-23+08%3A00%3A00&cvsroot=%2Fcvsroot
Keywords: regression
Hmm... What does that last frame look like?  I get this to assert on Linux, but
not crash....
In my debug build, I also don't crash.
I get this assertion, though:
http://wargers.org/test/mozilla/bt.txt
I crash also on Linux with Moz1.8b1 ¹, and I haven't got Flash plugin
TB4407577Y

¹ : Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b) Gecko/20050217
Yeah, that's the assert I was seeing too...
Flags: blocking1.8b3?
Flags: blocking-aviary1.1?
I get a crash with the same stack here:
http://houseofstrauss.co.uk/index.php
when I click at the "<>" image at the right just above the "Site Assistant" box.
It causes the whole right section to collapse/uncollapse. When I do it very
quickly after one another, I crash.
While minimising the testcase, I got basically the same as what is already attached.
Flags: blocking1.8b3? → blocking1.8b3-
I crash sometimes on Linux debug, but it takes a while to trigger. I crashed in
nsLineLayout::Reflowframe trying to reflow a deleted frame.
Flags: blocking-aviary1.1? → blocking-aviary1.1-
Attached patch fixSplinter Review
The root problem seems to be the layout bug Martijn mentioned in comment #1.
The problem seems to be that recreating frames for the <A> does not recreate
the containing block, because the <A>'s frame itself is not special. We need to
check to see whether the block's parent frame is special, because that's the
frame that will be the IB special frame in this case. I think in general if a
block frame causes IB-splitting then its parent frame will be special.

Fixing that problem seems to fix this bug. No more assertions, no more crashes.
Assignee: nobody → roc
Status: NEW → ASSIGNED
Attachment #191551 - Flags: superreview?(bzbarsky)
Attachment #191551 - Flags: review?(bzbarsky)
Attachment #191551 - Flags: superreview?(bzbarsky)
Attachment #191551 - Flags: superreview+
Attachment #191551 - Flags: review?(bzbarsky)
Attachment #191551 - Flags: review+
checked in. I'll apply for branch approval in a couple of days.
Comment on attachment 191551 [details] [diff] [review]
fix

no regressions seen yet. Fixes a crasher.
Attachment #191551 - Flags: approval1.8b4?
Attachment #191551 - Flags: approval1.8b4? → approval1.8b4+
Flags: blocking1.8b4+
checked in on branch.
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Keywords: fixed1.8
Resolution: --- → FIXED
v.fixed with 9/27 trunk and branch builds, testcase in comment #1 does not crash
Win32.
Status: RESOLVED → VERIFIED
Keywords: fixed1.8verified1.8
Depends on: 311615
Flags: in-testsuite?
Crash Signature: [@ nsLineLayout::ReflowFrame]
Added crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6051da676c88
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.