396750 - Crash [@ nsFloatCacheList::Tail] on trunk with unminimized testcase from bug 346405

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P4)

Description

[Martijn Wargers (dead)]

Trunk is still crashing with an unminimized testcase from bug 346405.
Roc advised to file a new bug for this.
It's very likely also crashing branch, so marking security sensitive for now.
I haven't really bothered making a minimized testcase yet, I can do that if wanted.

http://crash-stats.mozilla.com/report/index/8b35811c-6699-11dc-a846-001a4bd43e5c
0       nsFloatCacheList::Tail()        
mozilla/layout/generic/nsLineBox.cpp:849
1       nsFloatCacheFreeList::Append(nsFloatCacheList&)        
mozilla/layout/generic/nsLineBox.cpp:936
2       nsLineBox::FreeFloats(nsFloatCacheFreeList&)   
mozilla/layout/generic/nsLineBox.cpp:481
3       nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&,
nsLineList_iterator, int*, LineReflowStatus*, int)      
mozilla/layout/generic/nsBlockFrame.cpp:3271
4       nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&,
nsLineList_iterator, int*)        mozilla/layout/generic/nsBlockFrame.cpp:3188
5       nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator,
int*)
etc..

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I'd love a minimized testcase here. But based on past experience with bug 346405, your minimal testcase may not reproduce for me. Worth a try though if you've got the time.

Comment 2

[Martijn Wargers (dead)]

Attachment: unminimised testcase2

I'll add intermediate unminimized testcase, while minimizing. You should give a beep then when those don't crash anymore.

Comment 3

[Martijn Wargers (dead)]

Attachment: unminimized testcase3

This is crashing directly for me and with a different stack:
http://crash-stats.mozilla.com/report/index/bbac2c9e-7394-11dc-990d-001a4bd43e5c
0  	nsTableOuterFrame::GetContentInsertionFrame()  	 mozilla/layout/tables/nsTableOuterFrame.h:128
1 	nsBlockFrame::RenumberListsFor(nsPresContext*, nsIFrame*, int*, int) 	mozilla/layout/generic/nsBlockFrame.cpp:6430
2  	nsBlockFrame::RenumberListsInBlock(nsPresContext*, nsBlockFrame*, int*, int)  	 mozilla/layout/generic/nsBlockFrame.cpp:6396
3 	nsBlockFrame::RenumberLists(nsPresContext*) 	mozilla/layout/generic/nsBlockFrame.cpp:6376
etc...

Comment 4

[Martijn Wargers (dead)]

Attachment: unminimized testcase4

This is only crashing when zooming in or out.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

testcase3 does not crash for me. Nor does testcase4.

testcase2 does.

Comment 6

[Martijn Wargers (dead)]

Attachment: other testcase

This was based on a testcase that used to crash with the stacktrace in comment 0, but this resulting (reasonable) minimized testcase is crashing here:
http://crash-stats.mozilla.com/report/index/244a4bc5-745c-11dc-a7e5-001a4bd43ef6
0  	nsBlockFrame::DrainOverflowLines(nsBlockReflowState&)  	 mozilla/layout/generic/nsBlockFrame.cpp:4316
1 	nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsBlockFrame.cpp:911
2 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:722
3 	nsColumnSetFrame::ReflowChildren(nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&, nsColumnSetFrame::ReflowConfig const&, int, nsCollapsingMargin*) 	mozilla/layout/generic/nsColumnSetFrame.cpp:520
4 	nsColumnSetFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsColumnSetFrame.cpp:749
5 	nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, int, nsMargin&, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) 	mozilla/layout/generic/nsBlockReflowContext.cpp:339
6 	nsBlockFrame::ReflowFloat(nsBlockReflowState&, nsPlaceholderFrame*, nsMargin&, unsigned int&) 	mozilla/layout/generic/nsBlockFrame.cpp:5609
etc..

It should crash at once or after a few reloads.

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yeah, that one crashes on load...

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Well, it did. Now it doesn't, probably because of bug 397007.

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

testcase2 no longer crashes for me. Neither does the original testcase in the URL field.

Comment 10

[Martijn Wargers (dead)]

Yes, in current trunk build, unminimised testcase2 doesn't seem to crash anymore.
The original url doesn't seem to crash also (although it seems to hang the browser for a long time).

unminimized testcase3 is still crashing for me:
http://crash-stats.mozilla.com/report/index/b6d3fe2e-75b3-11dc-87df-001a4bd43ef6
0  	nsTableOuterFrame::GetContentInsertionFrame()  	 mozilla/layout/generic/nsColumnSetFrame.cpp:76
1 	nsBlockFrame::RenumberListsFor(nsPresContext*, nsIFrame*, int*, int)
etc..

unminimized testcase4 doesn't crash anymore for me, but it doesn't show a vertical scrollbar, which it should.

other testcase also doesn't crash anymore.

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

testcase 3 and testcase 4 both work fine for me.

Comment 12

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Martijn, any update on the testcases here?

Comment 13

[Martijn Wargers (dead)]

None of the testcases seem to crash anymore in current trunk build. Marking worksforme.