295292 - [FIXr]crash when using fixed positioning, with no data rendered inside element[@nsFrame::BoxReflow ]

Status: RESOLVED FIXED

(Core :: Layout, defect, P1)

Description

[Aaron Slunt]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050523 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050523 Firefox/1.0+

When having a div using fixed positioning, and no data in the innerhtml, with
overflow:hidden, firefox will hang/crash. Testcase will show it.

Reproducible: Always

Comment 1

[Aaron Slunt]

Attachment: testcase with empty div

Testcase showing crash using fixed positioning with empty div.

Comment 2

[Andrew Schultz]

Attachment: stacktrace

Comment 3

[Alexey N. Solofnenko]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050515 Firefox/1.0+

Does not crash, but eats 100% CPU and works very slow.

Comment 4

[Andrew Schultz]

I also hit two assertions with a debug build before it crashes.  a non-debug
doesn't actually crash for me, but loading the testcase never actually refreshes
the window and Mozilla uses a lot of CPU:

###!!! ASSERTION: Could not load scrollbars.css.:
'gStyleCache->mScrollbarsSheet', file
/build/andrew/moz-debug/mozilla/layout/style/nsLayoutStylesheetCache.cpp, line 88
###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never
called: 'metrics', file
/build/andrew/moz-debug/mozilla/layout/generic/nsFrame.cpp, line 5644

This looks like the same problem as in bug 292549, although that bug worksforme.
 Like that bug, the appears to have regressed from bug 240276

Comment 5

[Aaron Slunt]

Attachment: testcase using same div, but with innerhtml

Notice how that this is the exact same thing as the first testcase, except
there's data inside the div this time and there's no crash/hang.

Comment 6

[Martijn Wargers (dead)]

Attachment: Testcase3

This came from
http://forums.mozillazine.org/viewtopic.php?t=270929&postdays=0&postorder=asc&postsperpage=15&start=75#1493494

I think it is similar to this bug (same regression range), so attaching here.

Comment 7

[Aaron Slunt]

I personally think this should be fixed before deer park is shipped.

Comment 8

[Aaron Slunt]

1 more thing to add:

Even if you're able to successfully navigate out of the page that causes the
hang, the problem still persists and does not stop, no matter what, so in the
end, you have to end up ctrl+alt+deleting it, regardless of what you try to do
to get out of it (at least, from my experience).

Comment 9

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed patch

Should be pretty clear what's up -- we were reflowing everything again because
the size of our overflow-enabled fixed-pos guy had changed and we thought the
size of the main scrollframe had changed.  Then we got into a nice loop-like
situation.

Comment 10

[Joseph]

Attachment: related

I posted a similar bug in Mozillazine fourms a couple days ago.  I was told it
likely was the same or related to this bug.  It appears to have a similar
regression range.  If its not related then feel free to open a new bug.  I
don't know if Boris' patch has any effect on my bug.

This has affected Firefox trunk builds for a good while. It does not affect
1.0.  I don't try nightly builds that often, but the problem has been around at
least all month.  Its a bit of odd CSS that causes Firefox to take up >90% cpu
and it can never display the page.  It just keeps trying.

The problem seems to be with the combination of width:0, overflow:hidden, and
position:fixed. Remove or change any one of those lines and the page has no
problem rendering.  Mine does have text in the div.

If you get to see "page loaded" text then it worked fine.  With FF 1.0+ I never
see that and the entire UI becomes extremely sluggish.

Comment 11

[Aaron Slunt]

Changing title due to Joseph's reply.

For my problem, it was no data inside the div, which means basically there was
nothing to render in the div. With joseph, a width of 0, there's basically once
again nothing to render in the div if the width is 0, correct? If I'm mistaken,
then I'm sorry for changing the title.

Comment 12

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 184708 [details] [diff] [review]
Proposed patch

requesting approval for safe crash fix.

Comment 13

[chris hofmann]

Comment on attachment 184708 [details] [diff] [review]
Proposed patch

a=chofmann for b2

Comment 14

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 15

[Bob Clary [:bc] (inactive)]

layout/generic/crashtests/295292-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3

Comment 16

[Bob Clary [:bc] (inactive)]

layout/generic/crashtests/295292-2.html