325222 - [FIX]Crash with evil xul/mathml testcase, involving mi display: block and eq [@ nsLineLayout::ReflowFrame]

Status: VERIFIED FIXED

(Core :: MathML, defect, P2)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which makes Mozilla hang/crash on load.
It happens also in Mozilla1.7, so no recent regression

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (hangs/crashes on load)

Talkback ID TB14549442K:
nsLineLayout::ReflowFrame  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsLineLayout.cpp, line 981]
nsMathMLContainerFrame::ReflowForeignChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp, line 1027]
nsMathMLContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp, line 1005]
nsMathMLTokenFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/mathml/base/src/nsMathMLTokenFrame.cpp, line 181]
nsFrame::BoxReflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 6013]
nsFrame::RefreshSizeCache  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 5513]
nsFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsFrame.cpp, line 5721]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 946]
nsSprocketLayout::Layout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 260]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1065]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1065]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 217]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 742]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 239]
PresShell::InitialReflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 2784]
nsXULDocument::StartLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2049]
nsXULDocument::ResumeWalk  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2975]
nsXULDocument::EndLoad  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 679]
XULContentSinkImpl::DidBuildModel  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULContentSink.cpp, line 406]

Comment 2

[steve.swanson]

Attachment: naive patch

This patch does a little bit of wallpaper of the nsSpaceManager in nsMathMLContainerFrame::ReflowForeignChild() passed to the nsLineLayout, emulating similar code in nsSVGForeignObjectFrame::Reflow().  I've never dealt with a nsSpaceManager before, so don't know if what I've done is appropriate.

Comment 3

[rbs]

bz, this is the bug (it is not related to float) that I was thinking about when I posted my comment in bug 353894.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Do what blocks do

The effect is the same as the "naive patch".

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 239946 [details] [diff] [review]
Do what blocks do

Probably worth fixing on the branches.

Comment 7

[Mike Schroepfer]

Comment on attachment 239946 [details] [diff] [review]
Do what blocks do

Approved for RC2.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed on 1.8 branch.

Comment 9

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060925 Minefield/3.0a1

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 239946 [details] [diff] [review]
Do what blocks do

approved for 1.8.0 branch, a=dveditz for drivers

Comment 11

[Boris Zbarsky [:bzbarsky]]

Fixed for 1.8.0.8

Comment 12

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.8pre) Gecko/20061020 Firefox/1.5.0.8pre, no crash/hang with testcase.