385526 - Crash [@ gfxSkipCharsIterator::SetOffsets] with ::first-line, display: inline, white-space: nowrap on body and removing style

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which usually crashes current trunk builds within 400ms.
This regressed when the new textframe patch landed.

https://crash-reports.mozilla.com/reports/report/index/a60b902b-210b-11dc-95f4-001a4bd43ef6
0  	gfxSkipCharsIterator::SetOffsets(unsigned int,int)
1 	BuildTextRunsScanner::SetupBreakSinksForTextRun(gfxTextRun *,int,int)
2 	BuildTextRunsScanner::FlushFrames(int)
3 	BuildTextRunsScanner::ScanFrame(nsIFrame *)
4 	BuildTextRunsScanner::ScanFrame(nsIFrame *)
5 	BuildTextRuns
6 	nsTextFrame::EnsureTextRun(nsIRenderingContext *,nsIFrame *,nsLineList_iterator const *,unsigned int *)
7 	nsTextFrame::Reflow(nsPresContext *,nsHTMLReflowMetrics &,nsHTMLReflowState const &,unsigned int &)
8 	nsLineLayout::ReflowFrame(nsIFrame *,unsigned int &,nsHTMLReflowMetrics *,int &)
9 	nsInlineFrame::ReflowInlineFrame(nsPresContext *,nsHTMLReflowState const &,nsInlineFrame::InlineReflowState &,nsIFrame *,unsigned int &)

Comment 1

[Mats Palmgren (inactive)]

Looks like bug 386584

Comment 2

[Martijn Wargers (dead)]

This is still crashing with current trunk build.
From the comments in bug 386584, I guess this could be fixed by bug 385270.

Comment 3

[Martijn Wargers (dead)]

Bug 385270 was fixed, but I'm still crashing with current trunk build. It can take a few reloads, though (it reloads automatically).
http://crash-stats.mozilla.com/report/index/02d8a57a-3e3c-11dc-9f68-001a4bd46e84
0  	gfxSkipCharsIterator::SetOffsets(unsigned int,int)
1 	BuildTextRunsScanner::SetupBreakSinksForTextRun(gfxTextRun *,int,int)
2 	BuildTextRunsScanner::FlushFrames(int)
3 	BuildTextRunsScanner::ScanFrame(nsIFrame *)
4 	BuildTextRunsScanner::ScanFrame(nsIFrame *)
5 	BuildTextRuns
6 	nsTextFrame::EnsureTextRun(nsIRenderingContext *,nsIFrame *,nsLineList_iterator const *,unsigned int *)
7 	nsTextFrame::Reflow(nsPresContext *,nsHTMLReflowMetrics &,nsHTMLReflowState const &,unsigned int &)
8 	nsLineLayout::ReflowFrame(nsIFrame *,unsigned int &,nsHTMLReflowMetrics *,int &)
9 	nsInlineFrame::ReflowInlineFrame(nsPresContext *,nsHTMLReflowState const &,nsInlineFrame::InlineReflowState &,nsIFrame *,unsigned int &)

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

roc is fixing this over in bug 385270.

Comment 5

[Martijn Wargers (dead)]

Ok, I guess.
But the last time bug 385270 was fixed, this crash was still there.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Oh, sorry.  Let me reopen then; I shouldn't assume.

Comment 7

[(mostly gone) XtC4UaLL [:xtc4uall]]

Firefox crashes whenever clicking on "View 4 replies" in the first comment on this site: http://www.digg.com/tech_news/See_Who_s_Editing_Wikipedia_Diebold_the_CIA_a_Campaign

using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007081505 Minefield/3.0a8pre ID:2007081505

http://crash-stats.mozilla.com/report/index/a6845b42-4b8e-11dc-bfd9-001a4bd43ef6

0 gfxSkipCharsIterator::SetOffsets(unsigned int, int)
1 BuildTextRunsScanner::SetupBreakSinksForTextRun(gfxTextRun*, int, int)
2 BuildTextRunsScanner::BuildTextRunForFrames(void*)
3 BuildTextRunsScanner::FlushFrames(int)
4 BuildTextRuns
5 nsTextFrame::EnsureTextRun(nsIRenderingContext*, nsIFrame*, nsLineList_iterator const*, unsigned int*)
6 nsTextFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&)
7 nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, int&)
8 nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)
9 nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, int*, LineReflowStatus*, int)

Similar stacktrace to above or rather Bug 386584 ?

Comment 8

[Martijn Wargers (dead)]

Not crashing anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007081605 Minefield/3.0a8pre

Fixed by bug 385270.

Comment 9

[(mostly gone) XtC4UaLL [:xtc4uall]]

Confirmed Fixed with my digg.com example mentioned above

Comment 10

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8d965e3893b4

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8d965e3893b4