388049 - hangs while loading css test for multiple pseudo-elements, uses 120MBs of RAM

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[David Zbarsky (:dzbarsky)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007071003 SeaMonkey/2.0a1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a7pre) Gecko/2007071003 SeaMonkey/2.0a1pre

When you click to open the link, Mozilla hangs and stops responding

Reproducible: Always

Steps to Reproduce:
1. Go to http://www.w3.org/Style/CSS/Test/CSS2.1/current/t051202-c26-psudo-nest-00-c.htm
2. Watch it hang
3.
Actual Results:  
It hangs

Expected Results:  
It should render the test

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Profile of the hang

I can confirm the hang, not on initial load, but on reload.  Might have to do with the cache?

In any case, profiling the hang gives me:

Total hit count: 203594
Count %Total  Function Name
109433   53.8     gfxTextRun::IsClusterStart(unsigned int)
51963   25.5     nsTextFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&)
42198   20.7     nsAutoArrayPtr::operator gfxTextRun::CompressedGlyph*() const

The profile is attached.  Looks like a textframe issue.

d z, do you think you can construct a minimal testcase for this?  That is, remove all the HTML and CSS that's not needed to reproduce the hang?  That would be very helpful.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Oh, loading the page the first time (when it doesn't hang) gives:

###!!! ASSERTION: aPos out of range: '0 <= aPos && aPos < mCharacterCount', file ../../dist/include/thebes/gfxFont.h, line 556
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file ../../../../mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
WARNING: We shouldn't be backing up more than once! Someone must have set a break opportunity beyond the available width, even though there were better break opportunities before it: file ../../../mozilla/layout/generic/nsBlockFrame.cpp, line 3327

and some repeats of the above.  When we hang, 

###!!! ASSERTION: aPos out of range: '0 <= aPos && aPos < mCharacterCount', file ../../dist/include/thebes/gfxFont.h, line 556

is firing continuously.

Comment 3

[David Zbarsky (:dzbarsky)]

Attachment: testcase

Not sure if it can be any smaller, I tried my best.  Interestingly enough, if you comment out the the first line of css, then Mozilla hangs the first time that you open it.  Also, none of this happens on Firefox 2.0.0.4 on 3.0a7pre nightly.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

This patch fixes the assertions in this testcase. It's a simple error --- we just need to update mCurrentFramesAllSameTextRun along this other path.

It actually renders incorrectly, though --- the inline <strong> element seems to confuse things so that the entire paragraph gets rendered with the first-line style. I traced far enough to see that at some point we do create a textrun for the second and following lines with the right style, but I have to take a break from this for now. Followup bug.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 273904 [details] [diff] [review]
fix

a1.9=dbaron, although this doesn't actually need it since it's blocking1.9+.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c25668460f0d
Add crashtest.  r=mats  DONTBUILD

Comment 8

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/c25668460f0d