351485 - Crash [@ nsBlockFrame::RemoveFrame] with -moz-column-count, ::first-line and caret browsing enabled

Status: VERIFIED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes Mozilla when caret browsing is enabled.
This regressed between 2006-02-27 and 2006-02-28, it also crashes on the 1.8.1 branch, but not on the 1.8.0.x branch, so I guess this is a regression from bug 144000, somehow.

Talkback ID: TB22938974X
0x00000000
nsBlockFrame::RemoveFrame  [mozilla/layout/generic/nsBlockFrame.cpp, line 5602]
nsFrameManager::RemoveFrame  [mozilla/layout/base/nsFrameManager.cpp, line 705]
nsCSSFrameConstructor::ContentRemoved  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10065]
nsCSSFrameConstructor::ReinsertContent  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9604]
nsCSSFrameConstructor::ContentInserted  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9507]
nsCSSFrameConstructor::RecreateFramesForContent  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12001]
nsCSSFrameConstructor::RestyleElement  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10499]
nsCSSFrameConstructor::ProcessOneRestyle  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14020]
nsCSSFrameConstructor::ProcessPendingRestyles  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14068]
nsCSSFrameConstructor::RestyleEvent::HandleEvent  [mozilla/layout/base/nsCSSFrameConstructor.cpp, line 14130]
0x778b0c24
0x00200064
0xb8e80c75

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

I get a bunch of assertions in my debug build before I crash. Those might indicate something is going wrong:

###!!! ASSERTION: reflowing in the middle of frame construction: 'mPresContext->
mLayoutPhaseCount[eLayoutPhase_FrameC] == 0', file ../../dist/include/layout/nsP
resContext.h, line 833
###!!! ASSERTION: reflowing empty line: 'aLine->GetChildCount()', file c:/mozill
a/mozilla/layout/generic/nsBlockFrame.cpp, line 2656
###!!! ASSERTION: empty line: 'fromLine->GetChildCount()', file c:/mozilla/mozil
la/layout/generic/nsBlockFrame.cpp, line 2914
###!!! ASSERTION: Disagreement about whether it's a block or not: 'fromLine->IsB
lock() == fromLine->mFirstChild->GetStyleDisplay()->IsBlockLevel()', file c:/moz
illa/mozilla/layout/generic/nsBlockFrame.cpp, line 2918
###!!! ASSERTION: empty line: 'fromLine->GetChildCount()', file c:/mozilla/mozil
la/layout/generic/nsBlockFrame.cpp, line 2914
###!!! ASSERTION: Disagreement about whether it's a block or not: 'fromLine->IsB
lock() == fromLine->mFirstChild->GetStyleDisplay()->IsBlockLevel()', file c:/moz
illa/mozilla/layout/generic/nsBlockFrame.cpp, line 2918
###!!! ASSERTION: reflowing empty line: 'aLine->GetChildCount()', file c:/mozill
a/mozilla/layout/generic/nsBlockFrame.cpp, line 2656
###!!! ASSERTION: empty line: 'fromLine->GetChildCount()', file c:/mozilla/mozil
la/layout/generic/nsBlockFrame.cpp, line 2914
etc.

Comment 3

[Ginn Chen]

The testcase didn't crash my Firefox 2 release build

Comment 4

[Martijn Wargers (dead)]

This is indeed fixed now that the patch for bug 144000 has been backed out.
But I wonder if it would be possible to make the testcase crash again, by adding some javascript that puts the caret at some strategic position. My attempts at that, didn't reveal anything, though.