371993 - Crash with unminimized testcase that changes overflow styles rapidly

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, this crashes current trunk Mozilla builds a lot of times.
Unfortunately, minimizing it is rather tricky, the more I try to minimize it, the less eager Mozilla is to crash.

Marking security sensitve for now, because I use some 'special' code.

This regressed between 2007-02-23 and 2007-02-24:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-02-23+04&maxdate=2007-02-24+08&cvsroot=%2Fcvsroot
It seems to me this could be a regression of bug 370379, that one is already guilty of a few other regressions.

Comment 1

[Martijn Wargers (dead)]

Attachment: backtrace from debug build

Comment 2

[Martijn Wargers (dead)]

Attachment: original testcase

Comment 3

[Martijn Wargers (dead)]

Attachment: original testcase

Sorry, the xbl binding was also necessary.

Comment 4

[Eli Friedman]

Hmm, it's possible the patch for Bug 371620 fixes this (I messesd up my build somehow, so I can't check at the moment, but I'll check once I have it working again.)

Comment 5

[Eli Friedman]

Okay, as I suspected, my build doesn't crash, probably due to the fix for bug 371620.  Could you try updating to tip to see if it's fixed for you?  (I just checked it in.)

Comment 6

[Martijn Wargers (dead)]

If you don't see it crash anymore, then you can mark it fixed. I'll do that now. I'll check it with tomorrow's daily build, thanks.

Comment 7

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a3pre) Gecko/20070228 Minefield/3.0a3pre

Comment 8

[Myk Melez [:myk] [@mykmelez]]

I don't see the crash in Linux on the 1.8 branch (Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4pre) Gecko/20070322 BonEcho/2.0.0.4pre).  Maybe that because this bug is Windows-only, although the patch in bug 371620 that fixed this bug doesn't look Windows-specific.

I do, however, see huge increases in memory consumption (on the order of 10MB/second) after opening the latest testcase.

Comment 9

[chris hofmann]

when I ran the test case on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/2007030919 Firefox/2.0.0.3 I went from about 85 MB to 90 MB mem use then stabilzed around there...  no crash.  seems fixed on the branch as well.

Comment 10

[Myk Melez [:myk] [@mykmelez]]

More info on that memory consumption: Firefox goes from ~100MB to about ~500MB resident memory on my machine after I load the testcase.  It seems to plateau at that point (which is near the memory limit of my machine) for a few seconds, then it crashes.  But Talkback doesn't fire up after the crash.

Comment 11

[Martijn Wargers (dead)]

Well, I guess that's bad for branch, but probably not too bad.
This was a trunk regression only. If you want to open up this bug, that's fine by me.