383089 - Crash [@ nsIFrame::GetPositionIgnoringScrolling]

Status: RESOLVED WORKSFORME

(Core :: Layout: Floats, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox within a minute)

On about 5% of loads, this testcase triggers three assertions and a crash.  If it is loaded locally, it crashes reliably within a minute (because it reloads itself).

###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 735

###!!! ASSERTION: mOriginalDisplay has not been properly initialized: 'mStyleDisplay->mOriginalDisplay != NS_STYLE_DISPLAY_NONE', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 829

###!!! ASSERTION: Should hit cbrs->frame before we run off the frame tree!: 'aContainingBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1014

Thread 0 Crashed:
0   nsIFrame::GetPositionIgnoringScrolling + 15 (nsHTMLReflowState.cpp:668)
1   nsHTMLReflowState::CalculateHypotheticalBox + 1222 (nsHTMLReflowState.cpp:1015)
2   nsHTMLReflowState::InitAbsoluteConstraints + 407 (nsHTMLReflowState.cpp:1070)
3   nsHTMLReflowState::InitConstraints + 1576 (nsHTMLReflowState.cpp:1756)
4   nsHTMLReflowState::Init + 308 (nsHTMLReflowState.cpp:288)
5   nsHTMLReflowState::nsHTMLReflowState[in-charge] + 969 (nsHTMLReflowState.cpp:181)
6   nsBlockFrame::ReflowFloat + 473 (nsBlockFrame.cpp:5275)
7   nsBlockReflowState::FlowAndPlaceFloat + 406 (nsBlockReflowState.cpp:741)
8   nsBlockReflowState::AddFloat + 380 (nsBlockReflowState.cpp:546)
9   nsLineLayout::AddFloat + 49 (nsLineLayout.cpp:256)
10  nsLineLayout::ReflowFrame + 1437 (nsLineLayout.cpp:925)
11  nsBlockFrame::ReflowInlineFrame + 105 (nsBlockFrame.cpp:3432)
12  nsBlockFrame::DoReflowInlineFrames + 692 (nsBlockFrame.cpp:3252)
...

Comment 1

[Eli Friedman]

I can't crash this testcase... does it still crash for you?

Comment 2

[Jesse Ruderman]

WFM on trunk (even without your patch for bug 387201).

Comment 3

[Jesse Ruderman]

Attachment: testcase with clearInterval

Oops, the testcase was calling location.reload() every 5ms and not successfully reloading (when loaded from Bugzilla) as a result.

Comment 4

[Jesse Ruderman]

I let it go for a few minutes and it didn't crash :)

Comment 5

[Jesse Ruderman]

Crashtest checked in (without the self-reloading, of course).