317682 - Crash with evil testcase using display:table and dd with position:relative; float:right

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

(cc-ing bernd, maybe this has something to do with tables)

See upcoming testcase, it crashes for me when hovering over the text.
It seems like a regression, it doesn't crash in 2005-04-29 build, but it crashes in 2005-04-30 build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-04-28+23%3A00%3A00&maxdate=2005-04-30+08%3A00%3A00&cvsroot=%2Fcvsroot
Maybe regression from bug 290377?

Talkback ID: TB12208000Q

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Bernd]

looks like the testcase has already enough issues on load

###!!! ASSERTION: huh?: 'pfd->mFrame == aFrame', file d:/moz_src/mozilla/layout/
generic/nsLineLayout.cpp, line 521
###!!! ASSERTION: huh?: 'pfd->mFrame == aFrame', file d:/moz_src/mozilla/layout/
generic/nsLineLayout.cpp, line 521
###!!! ASSERTION: huh?: 'pfd->mFrame == aFrame', file d:/moz_src/mozilla/layout/
generic/nsLineLayout.cpp, line 521
WARNING: aFrame is already associated with a region, file d:/moz_src/mozilla/lay
out/generic/nsSpaceManager.cpp, line 814
###!!! ASSERTION: bad float placement: 'NS_SUCCEEDED(rv)', file d:/moz_src/mozil
la/layout/generic/nsBlockReflowState.cpp, line 1005
WARNING: aFrame is already associated with a region, file d:/moz_src/mozilla/lay
out/generic/nsSpaceManager.cpp, line 814
###!!! ASSERTION: bad float placement: 'NS_SUCCEEDED(rv)', file d:/moz_src/mozil
la/layout/generic/nsBlockReflowState.cpp, line 1005
###!!! ASSERTION: leak: 'mSpansAllocated == mSpansFreed', file d:/moz_src/mozill
a/layout/generic/nsLineLayout.cpp, line 355
###!!! ASSERTION: leak: 'mFramesAllocated == mFramesFreed', file d:/moz_src/mozi
lla/layout/generic/nsLineLayout.cpp, line 356
###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aN
extSibling', file d:/moz_src/mozilla/layout/generic/nsIFrame.h, line 695
###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aN
extSibling', file d:/moz_src/mozilla/layout/generic/nsIFrame.h, line 695

Comment 3

[Martijn Wargers (dead)]

I have filed two bugs with similar assertions: bug 316318 and bug 317278

Comment 4

[Sébastien Auger]

this should never happen .. even if the code that make it crash is poorly done, no offense martijn ;-) j/k

Comment 5

[Boris Zbarsky [:bzbarsky]]

I really have no idea what's going on here...  Anyone familiar with line layout want to take a look at the pfd asserts?  I suspect those are the key...

Comment 6

[Bernd]

I think the core issue is bug 222194, we don't create a anonymous block around the inline frame and as a consequence we reflow the inline without creating a line object.

Comment 7

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20051206 Firefox/1.6a1

I don't crash anymore with a build that the fix for bug 317855 checked in. I do still get the assertions, though.

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Stack

Comment 9

[Boris Zbarsky [:bzbarsky]]

stephend, does that mean you crash with current trunk on this testcase?

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #9)
> stephend, does that mean you crash with current trunk on this testcase?

Yes, I should have been more explicit.  Build 2005-12-09-09 on Windows XP, SeaMonkey trunk gave that stack.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Huh.  I get lots of asserts on Linux, but no crash....

Comment 12

[Bernd]

the assertions got fixed by bug 307992, wfm, Stephen could you test with a build that incorporates Davids checkin from 2005-12-15 15:08?

Comment 13

[Stephen Donner [:stephend] Not actively reading bugmail]

bernd: the testcase is now working fine (no crash) with trunk SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051216 Mozilla/1.0

Comment 14

[Bernd]

marking as fixed 

Comment 15

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified; see comment 13.

Comment 16

[Mike Beltzner [:beltzner, not reading bugmail]]

dbaron, is this OK to take for branch?

Comment 17

[Mike Schroepfer]

Clearing blocking flag since this is covered in other bugs.