[sg:critical] because before I reduced the testcase, I got crashes with random addresses on top. The only reduced testcases I managed to make were for nondeterministic null dereferences, so I will retest with the original file once this is fixed.
Stack signatures (functions on top of the stack) included:
[@ nsCSSFrameConstructor::BeginBuildingScrollFrame] -- with random at top
Created attachment 216197 [details]
reduced testcase for crash [@ nsIView::GetOffsetTo]
Usually crashes after about 10 reloads.
Created attachment 216414 [details]
reduced tectase that triggers assertion
###!!! ASSERTION: unexpected second call to SetInitialChildList: 'Not Reached',
file d:/moz_src/mozilla/layout/generic/nsContainerFrame.cpp, line 108
This happens on the scroll frame around the rowgroup which is a abs. containing block.
So what's GetAbsoluteContainingBlock returning here, and why?
Created attachment 219177 [details]
testcase without abs.pos. which triggers the assert
rowgroup pseudos are the parent frames at pseudoFrames.mRowGroup.mFrame. If we build however a scrollframe for the rowgroup, we have the scrollframe there and then we put the row on the childlist of the.... scrollframe allready occupied by the rowgroupframe. (The typical case of: NOBODY expects the Spanish Inquisition!)
Created attachment 219269 [details] [diff] [review]
This code is wrong since it has been written, the typical effect is that we loose the rowframe and all its children. Then its only a question what you stuffed inside this row to determine where we crash, abs. pos with opacity, seems nice, the abs.pos animated gif should work too. I guess we need to get this, once it has baked, back to branches.
fix checked in, open for some stress tests by Jesse
Comment on attachment 219269 [details] [diff] [review]
approved for 1.8.0 branch, a=dveditz for drivers
fix checked in into branches
v.fixed on 1.8.0 branch with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US;
rv:126.96.36.199) Gecko/20060626 Firefox/188.8.131.52, no crash with testcase.
(In reply to comment #0)
> [sg:critical] because before I reduced the testcase, I got crashes with random
> addresses on top. The only reduced testcases I managed to make were for
> nondeterministic null dereferences, so I will retest with the original file
> once this is fixed.
Jesse: Do you still have the original testcase, and if so did this really fix it?
asac: I don't think anyone tested this on the 1.7 branch.
I think I tested the original testcase (and various intermediate testcases) shortly after this was fixed and didn't hit any more crashes. I think the more recent fix for bug 331883 affects how Gecko thinks about this testcase.
Created attachment 232739 [details] [diff] [review]
ff2b2 no crash windows, linux, macppc
ff2b2 windows, linux, macppc no crash; windows, linux no assert
ff2b2 windows, linux, macppc; windows, linux no assert
verified fixed 1.8
Crashtests checked in.
The crashtests trigger CSS errors because bug 331883 has been fixed -- web pages cannot reference these internal pseudo-elements at all.