331446 - Crash [@ nsFrameManager::ReResolveStyleContext] involving columns, tables, positioning

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

[sg:critical] based on stack traces with random addresses on top.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

Attachment: stack trace (mac nightly)

Comment 3

[Martijn Wargers (dead)]

Tables are used in the testcase.

Comment 4

[Jesse Ruderman]

Columns too :)

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I need to turn off absolute positioning inside columns for now. See bugs 312963 and bug 288357.

Comment 6

[Bernd]

we hit a couple of asserts before the crash:

###!!! ASSERTION: Must only be called on reflowed lines: '!(GetStateBits() & NS_
FRAME_IS_DIRTY)', file d:/moz_src/mozilla/layout/generic/nsFrame.cpp, line 3570
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
WARNING: Couldn't add reflow command, so splitting.
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016
###!!! ASSERTION: Deleting out of flow without tearing down placeholder relation
ship: '!(mState & NS_FRAME_OUT_OF_FLOW) || !shell->FrameManager()->GetPlaceholde
rFrameFor(this)', file d:/moz_src/mozilla/layout/generic/nsFrame.cpp, line 637
###!!! ASSERTION: frame was not removed from primary frame map before destructio
n or was readded to map after being removed: 'Not Reached', file d:/moz_src/mozi
lla/layout/base/nsFrameManager.cpp, line 699
###!!! ASSERTION: SplitRowGroup currently supports only paged media: 'aPresConte
xt->IsPaginated()', file d:/moz_src/mozilla/layout/tables/nsTableRowGroupFrame.c
pp, line 1016

Comment 7

[Daniel Veditz [:dveditz]]

with a debug windows 1.5.0.2 build I consistently crash in nsIFrame::GetStyleDataExternal with a null mStyleContext -- seems safe enough.

On the trunk this is a deleted object and it crashes a bit later, though not quite where the Mac does in the attached trace.

Comment 8

[Leon Sha]

(In reply to comment #6)
> ###!!! ASSERTION: Deleting out of flow without tearing down placeholder
> relation
> ship: '!(mState & NS_FRAME_OUT_OF_FLOW) ||
> !shell->FrameManager()->GetPlaceholde
> rFrameFor(this)', file d:/moz_src/mozilla/layout/generic/nsFrame.cpp, line 637

This assert cause the problem. Just unregister the Placeholder Frame in sFrame.cpp can avoid the crash. But I don't it is a good solution. 

Comment 9

[Leon Sha]

This bug is gone on latest trunk.
Seems that the patch for bug 338770 fix the problem.

Comment 10

[Martijn Wargers (dead)]

Indeed, this doesn't crash anymore on current trunk builds. Marking fixed then. Fixed by bug 338770.

Comment 11

[Daniel Veditz [:dveditz]]

nominating for 1.8.0 because this is the bug with the testcase.

Comment 12

[Daniel Veditz [:dveditz]]

bug 338770 fixed on the 1.8.0 branch

qawanted: please verify that this variant is actually fixed.

Comment 13

[Martijn Wargers (dead)]

I'm already not crashing with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060706 Firefox/1.5.0.5

I'm crashing with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

So on the 1.5.0.x branch it seems to be fixed somehow between that period.

Comment 14

[Bob Clary [:bc] (inactive)]

https://bugzilla.mozilla.org/attachment.cgi?id=215994
ff2b2 windows, linux, macppc no crash
verified fixed 1.8

Comment 15

[alice nodelman [:alice] [:anode]]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7pre) Gecko/20060821 Firefox/1.5.0.7pre

https://bugzilla.mozilla.org/attachment.cgi?id=215994, no crash.

verified 1.0.8.7

Comment 16

[Jesse Ruderman]

Crashtest checked in.