386812 - Crash [@ BuildTextRunsScanner::FindBoundaries] with large padding, floats, white-space: pre

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Loading the testcase triggers:

###!!! ASSERTION: Frame is not in the block!!!: 'line != block->end_lines()', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrameThebes.cpp, line 1117

###!!! ASSERTION: running past end: 'mCurrent != mListLink', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsLineBox.h, line 619

Crash [@ BuildTextRunsScanner::FindBoundaries]

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

I'm hitting this crash a lot, enough to make it difficult to look for other bugs.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

What's happening here is that because the padding eats up all available space, we don't have room to place any floats. This causes nsBlockReflowState::FlowAndPlaceFloat to fail, returning false, which is interpreted as the float not fitting on the page, so we create overflow. Then we crash because the textrun-related code can't handle being in overflow.

I'll fix the textrun code to handle overflow situations, but we should also fix the underlying bug. I think basically we need to be able to return zero-width but nonzero height available space and force floats to fit into it.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

This makes BuildTextRunForFrames (and hence EnsureTextRun) work even when the target frame is in the overflow-list of a block.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Sorry, this was the wrong patch!

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

May be fixed by bug 390050.

Comment 7

[Jesse Ruderman]

This testcase no longer crashes/asserts.

Comment 8

[Jesse Ruderman]

Crashtest checked in.