339651 - Crash [@ nsBlockFrame::DoRemoveFrame] [@ nsLineBox::RemovePlaceholderDescendantsOf] involving floats, block+inline

Status: RESOLVED FIXED

(Core :: Layout: Floats, defect)

Description

[Jesse Ruderman]

To reproduce:
1. Load the testcase in a ***debug*** build.  (I first saw the crash in a nightly, but the reduced testcase only crashes debug builds reliably.)

Result: Crash with nsBlockFrame::DoRemoveFrame second from the top.  The top is frequently nsLineBox::RemovePlaceholderDescendantsOf, something near 0, or something near 0xDDDDDDDD, but I think it can be anything.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

Attachment: stack trace (mac debug)

Comment 3

[Jesse Ruderman]

Can't reproduce on Windows (debug).

Comment 4

[Jesse Ruderman]

Attachment: Valgrind log

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The first bit of the valgrind output makes it look like placeholder frame lifetime issues.

Comment 6

[Jesse Ruderman]

Still crashes an hours-old Mac trunk debug build.

It scares me that Gecko crashes with such a simple float testcase.  (Simple in that it only involves floats and no other special layout things, at least.)

Comment 7

[Martijn Wargers (dead)]

Does it crash in a branch build, btw?

Comment 8

[Jesse Ruderman]

No crash with my 1.8.0.x branch debug build.

Comment 9

[Mats Palmgren (inactive)]

Attachment: Frame dump

This bug has the same underlying cause as bug 348688 and is fixed by
the patch in that bug.

Comment 10

[Mats Palmgren (inactive)]

Fixed by bug 348688

Comment 11

[Jesse Ruderman]

Crashtest checked in.