344359 - Crash [@ nsLayoutUtils::GetEventCoordinatesRelativeTo] with testcase using position: relative and generated content

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcases which make current trunk Mozilla builds crash.
I'm marking this security sensitive for now, because the most minimesed crasher testcase gives me a bogus stack.

This regressed between 2006-03-12 and 2006-05-04. I don't get a crash on my other computer (where I have all my older daily builds stored). Maybe the crash is resolution dependant. The other computer has 1024*68, this one has 1440*900.

Talkback ID from unminimised testcase: TB20860892X
0x00000000
nsLayoutUtils::GetEventCoordinatesRelativeTo   PresShell::HandleEvent   nsViewManager::HandleEvent   nsViewManager::DispatchEvent   HandleEvent   nsWindow::DispatchEvent   nsWindow::ProcessMessage   0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
0x7ffdfc00
etc...

Talkback ID from minimised testcase:
0x011145dc
0xd3690012

Comment 1

[Martijn Wargers (dead)]

Attachment: Unminimised testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: Almost minimised testcase

This almost minimised testcase triggers the same stack as the unminimised testcase.

Btw, the crash only happens on first load for all testcase.

Comment 3

[Martijn Wargers (dead)]

Attachment: Minimised testcase

This minimised testcase triggers a bogus stack for me.

Comment 4

[Martijn Wargers (dead)]

Attachment: Further minimised testcase which triggers assertion

Prior to the crash, I see an assertion in my debug build. I suspect that gives an indication of where things go wrong. 
So I made a further minimised testcase that still triggers this assertion:
###!!! ASSERTION: reflowing in the middle of frame construction: 'mPresContext->
mLayoutPhaseCount[eLayoutPhase_FrameC] == 0', file ../../dist/include/layout/nsP
resContext.h, line 833

Comment 5

[Martijn Wargers (dead)]

Attachment: Backtrace from assertion

Comment 6

[Mats Palmgren (inactive)]

WFM, SeaMonkey 2006-07-10-01 trunk Linux (1600x1200).

Comment 7

[Martijn Wargers (dead)]

Ok, I found out why it didn't crash on the other computer, you need to have caret browsing enabled to get the crash on the testcases.

Comment 8

[Martijn Wargers (dead)]

Ok, this is now wfm with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060713 Minefield/3.0a1

Comment 9

[Martijn Wargers (dead)]

Sorry, not wfm yet. When I load the testcases directly from file, I still crash with the latest trunk build.

Comment 10

[Martijn Wargers (dead)]

All testcases are worksforme now with current trunk build.
I don't see the assertion anymore with current debug trunk build with the assertion testcase.