30305 - "universal dialog" causes assertions in nsGfxTextControlFrame

Status: VERIFIED FIXED

(Core :: Layout: Form Controls, defect, P3)

Description

[Chris Waterson]

According to what rods and danm have said on n.p.m.builds, my guess is that 
this is a problem with the way that boxes are flowing a collapsed GFX text 
controls. I'll call it a "form control" bug to start with, though.

To reproduce, you'll need a debug build.

1. Do something to bring up the "universal dialog"; e.g.,

- mail password dialog
- password-protected website, http://www.slackmaster.org/, for example ;-)

2. Whammo. You'll get four or five assertions in the nsGfxTextControlFrame, 
line 1916 ("form control's computed width is < 0"). Stack crawl below.

This is pretty annoying in a debug build, but doesn't appear to have any ill 
consequences if you steamroller over it.

nsGfxTextControlFrame::CalculateSizeStandard(nsIPresContext * 0x040ba540, 
nsIRenderingContext * 0x040a0530, nsIFormControlFrame * 0x029f74bc, const 
nsSize & {width=-165 height=330}, nsInputDimensionSpec & {...}, nsSize & 
{width=2100 height=210}, nsSize & {width=2100 height=0}, int & 0, int & 0, int 
& 6750318, nsMargin & {top=15 right=15 bottom=15 left=15}, nsMargin & ...) line 
1916
nsGfxTextControlFrame::ReflowStandard(nsGfxTextControlFrame * const 0x029f7490, 
nsIPresContext * 0x040ba540, nsHTMLReflowMetrics & {...}, const 
nsHTMLReflowState & {...}, unsigned int & 0, nsMargin & {top=15 right=15 
bottom=15 left=15}, nsMargin & {top=15 right=15 bottom=15 left=15}) line 1998
nsGfxTextControlFrame::Reflow(nsGfxTextControlFrame * const 0x029f7490, 
nsIPresContext * 0x040ba540, nsHTMLReflowMetrics & {...}, const 
nsHTMLReflowState & {...}, unsigned int & 0) line 2147 + 42 bytes
nsBoxFrameInner::FlowChildAt(nsIFrame * 0x029f7490, nsIPresContext * 
0x040ba540, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0, nsCalculatedBoxInfo & {...}, int 450, int 0, int 1, nsIFrame 
* & 0x00000000, int & 1, const nsString & {""}) line 2262
nsBoxFrameInner::FlowChildren(nsIPresContext * 0x040ba540, nsHTMLReflowMetrics 
& {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsIFrame * & 
0x00000000, nsRect & {x=0 y=0 width=0 height=420}, nsSize & {width=2900 
height=0}, int & 0) line 1479
nsBoxFrame::Reflow(nsBoxFrame * const 0x029f73a4, nsIPresContext * 0x040ba540, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 1206
nsBoxFrameInner::FlowChildAt(nsIFrame * 0x029f73a4, nsIPresContext * 
0x040ba540, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0, nsCalculatedBoxInfo & {...}, int 0, int 0, int 1, nsIFrame * 
& 0x00000000, int & 0, const nsString & {""}) line 2262
nsBoxFrameInner::FlowChildren(nsIPresContext * 0x040ba540, nsHTMLReflowMetrics 
& {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsIFrame * & 
0x00000000, nsRect & {x=0 y=0 width=2900 height=896}, nsSize & {width=2900 
height=896}, int & 345) line 1479
nsBoxFrame::Reflow(nsBoxFrame * const 0x029f733c, nsIPresContext * 0x040ba540, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 1206
nsBoxFrameInner::FlowChildAt(nsIFrame * 0x029f733c, nsIPresContext * 
0x040ba540, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0, nsCalculatedBoxInfo & {...}, int 0, int 3720, int 1, nsIFrame 
* & 0x00000000, int & 0, const nsString & {""}) line 2289
nsBoxFrameInner::FlowChildAt(nsIFrame * 0x029f733c, nsIPresContext * 
0x040ba540, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0, nsCalculatedBoxInfo & {...}, int 0, int 3720, int 1, nsIFrame 
* & 0x00000000, int & 0, const nsString & {""}) line 2068 + 62 bytes
nsBoxFrameInner::FlowChildren(nsIPresContext * 0x040ba540, nsHTMLReflowMetrics 
& {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsIFrame * & 
0x00000000, nsRect & {x=0 y=0 width=2900 height=4976}, nsSize & {width=2900 
height=1406}, int & 1335) line 1479
nsBoxFrame::Reflow(nsBoxFrame * const 0x029f6de0, nsIPresContext * 0x040ba540, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 1206
nsContainerFrame::ReflowChild(nsIFrame * 0x029f6de0, nsIPresContext * 
0x040ba540, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 
0, int 0, unsigned int 0, unsigned int & 0) line 638 + 31 bytes
RootFrame::Reflow(RootFrame * const 0x029f6da4, nsIPresContext * 0x040ba540, 
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) 
line 331
nsContainerFrame::ReflowChild(nsIFrame * 0x029f6da4, nsIPresContext * 
0x040ba540, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 
0, int 0, unsigned int 0, unsigned int & 0) line 638 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x029f6d68, nsIPresContext * 
0x040ba540, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 531
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0408ec80, 
nsIPresContext * 0x040ba540, nsHTMLReflowMetrics & {...}, const nsSize & 
{width=1590 height=30}, nsIRenderingContext & {...}) line 145
PresShell::ProcessReflowCommands(PresShell * const 0x040bd8b0, int 0) line 2035
PresShell::FlushPendingNotifications(PresShell * const 0x040bd8b0) line 2500
nsXULDocument::FlushPendingNotifications(nsXULDocument * const 0x040bae00) line 
1747
nsGenericHTMLElement::GetPrimaryFrame(nsIHTMLContent * 0x0404d920, 
nsIFormControlFrame * & 0x00000000, int 1) line 1943
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x0404d920, 
nsIPresContext * 0x040ba540, nsEvent * 0x0012c53c, nsIDOMEvent * * 0x00000000, 
unsigned int 1, nsEventStatus * 0x0012c560) line 842 + 40 bytes
nsEventStateManager::SendFocusBlur(nsEventStateManager * const 0x036fd780, 
nsIPresContext * 0x040ba540, nsIContent * 0x0404d920) line 2378
nsEventStateManager::SetContentState(nsEventStateManager * const 0x036fd780, 
nsIContent * 0x0404d920, int 2) line 2162
nsHTMLInputElement::SetFocus(nsHTMLInputElement * const 0x0404d928, 
nsIPresContext * 0x040ba540) line 717
nsHTMLInputElement::Focus(nsHTMLInputElement * const 0x0404d910) line 700 + 25 
bytes
HTMLInputElementFocus(JSContext * 0x0404fda0, JSObject * 0x029e9e50, unsigned 
int 0, long * 0x029f4dac, long * 0x0012c83c) line 840 + 15 bytes
js_Invoke(JSContext * 0x0404fda0, unsigned int 0, unsigned int 0) line 665 + 26 
bytes
js_Interpret(JSContext * 0x0404fda0, long * 0x0012d13c) line 2292 + 15 bytes
js_Invoke(JSContext * 0x0404fda0, unsigned int 0, unsigned int 0) line 681 + 13 
bytes
js_Interpret(JSContext * 0x0012d948, long * 0x0012d924) line 2292 + 15 bytes
js_Invoke(JSContext * 0x0000003f, unsigned int 1, unsigned int 0) line 681 + 13 
bytes
js_InternalInvoke(JSContext * 0x00000001, JSObject * 0x01b8dc20, long 115, 
unsigned int 49193128, unsigned int 16947200, long * 0x0012dac0, long * 
0x027b7d2f) line 754 + 19 bytes
JS_CallFunctionValue(JSContext * 0x0012daf0, JSObject * 0x027b71be, long 
57949488, unsigned int 21967024, long * 0x037440f4, long * 0x00000000) line 
2790 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x00000000, void * 
0x00000000, void * 0x037454f0, unsigned int 67747840, void * 0x00000040, int * 
0x01432a4c) line 562 + 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x0fffffff) line 128 + 57 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x00000000, 
nsIDOMEvent * 0x00000012, unsigned int 43126264, unsigned int 43126168) line 
697 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x02920de0, nsEvent * 
0x02c6fbd0, nsIDOMEvent * * 0x02cbd7e0, unsigned int 42882224, nsEventStatus * 
0x00000002) line 1248 + 35 bytes
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x00000000, 
nsIPresContext * 0x028e54b0, nsEvent * 0x02c6fbd0, nsIDOMEvent * * 0x00000000, 
unsigned int 4, nsEventStatus * 0x002e0bec) line 374
nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x035866fc, nsIDocumentLoader 
* 0x0358600c, nsIChannel * 0x000006f0, unsigned int 63) line 2661 + 51 bytes
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x0000003f, nsIChannel 
* 0x77f3b048, unsigned int 2012467648) line 603
nsDocLoaderImpl::DocLoaderIsEmpty(unsigned int 63) line 494
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x035867bc, nsIChannel * 
0x0358600c, nsISupports * 0x000007b0, unsigned int 63, const unsigned short * 
0x0000003f) line 438
nsLoadGroup::RemoveChannel(nsLoadGroup * const 0x77f3b048, nsIChannel * 
0x77f3d1c0, nsISupports * 0x00000004, unsigned int 0, const unsigned short * 
0x029c8d38) line 535 + 42 bytes
nsFileChannel::OnStopRequest(nsFileChannel * const 0x77f3b048, nsIChannel * 
0x77f3d1c0, nsISupports * 0x00000004, unsigned int 0, const unsigned short * 
0x029c8d38) line 455
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x0000003f) line 
292
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x029c8d38) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x0000003f) line 554 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x035868fc) line 499 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0000003f, unsigned int 2012459080, unsigned 
int 2012467648, long 4) line 1003 + 9 bytes
USER32! 77e71250()
04049f80()

Comment 1

[Chris Waterson]

Setting self as QA contact since you need a debug build to reproduce.

Comment 2

[rods (gone)]

Asking for beta1 because it is so annoying because it happens so much in the 
debug build and that I have the fix.

Comment 3

[rods (gone)]

Attachment: patch file for fixing the GfxText

Comment 4

[rods (gone)]

I have a fix for the GfxText directly, but waterson and I feel it is a more 
fundemental issue with boxes. They should be passing negitive values to frames 
for laying out.

Reassign to eric, attached patch for GfxText, clearing Status Whiteboard and 
leaving beta1

Comment 5

[rods (gone)]

Oops, I guess I should have explained the problem more clearly. Plain and 
simple, boxes send negitive values in the mComputedSize values, I assume this 
happens possibly when the display style is "collapsed". 

Also, note that the frames cannot simply return a desireed size that is negitive 
because if the frame has a view, the view then tries to set the window to neg 
size and we get an assert in nsWindow.cpp

Comment 6

[Phil Peterson]

PDT+ to stop the assertions. If there are more issues with boxes, we'd like to 
know what the user-visible symptoms are.

Comment 7

[Eric Vaughan]

Looking at this.

Comment 8

[Eric Vaughan]

I have a fix. I'm testing it now.

Comment 9

[Eric Vaughan]

Fixed

Comment 10

[leger]

Ok for Verify per Waterson.