289032 - Crash/hang with this evil testcase (overflow:scroll; position:absolute)

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Unfortunately, I am not able (yet maybe) to make the testcase any simpler.

The testcase doesn't crash or hang in the 2005-04-03 7:31am Firefox trunk build.
It crashes or hangs in the 2005-04-04 7:23am Firefox trunk build.
My guess would be that it is a regression from bug 288117.
The crash should normally happen within 10s or so.
I'll attach stacktraces from my up to date debug build.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: Stacktrace1

This is the stacktrace from the assertion I get before the crash:
###!!! ASSERTION: Bogus state: '!mLastChild->GetNextSibling()

Comment 3

[Martijn Wargers (dead)]

Attachment: Stacktrace2

This is the stacktrace from the actual crash.

Comment 4

[Boris Zbarsky [:bzbarsky]]

roc, this looks like you.... 

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

In GTK2, this triggers tons of assertions about widget reparenting not being
implemented --- but we don't crash. My guess is that although widget reparenting
is implemented in Windows, it's unreliable and eventually corrupts things. The
patch in bug 288949 avoids widget reparenting; my guess is that it will fix this
bug.

Comment 6

[Martijn Wargers (dead)]

Ok, this seems to be fixed by the fix for bug 288949. It can crash for me with
2005-04-07 build, but I can't make it crash with 2005-04-08 build.