403763 - Crash [@ nsBox::DoesNeedRecalc] with display: -moz-grid-group, generated content and textZoom

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build on load.
Because of the use of enhanced privileges, you need to download it to your computer.

It seemed to have regressed between 2007-07-25 and 2007-07-26:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-07-25+04&maxdate=2007-07-26+09&cvsroot=%2Fcvsroot
Regression from bug 386640, somehow?

http://crash-stats.mozilla.com/report/index/8fe25d23-92b4-11dc-937c-001a4bd46e84
0  	nsBox::DoesNeedRecalc(nsSize const&)  	 mozilla/layout/xul/base/src/nsBox.cpp:418
1 	nsFrame::GetMinSize(nsBoxLayoutState&) 	mozilla/layout/generic/nsFrame.cpp:5863
2 	nsSprocketLayout::GetMinSize(nsIFrame*, nsBoxLayoutState&, nsSize&) 	mozilla/layout/xul/base/src/nsSprocketLayout.cpp:1393
3 	nsGridRowGroupLayout::GetMinSize(nsIFrame*, nsBoxLayoutState&, nsSize&) 	mozilla/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp:160
4 	nsBoxFrame::GetMinSize(nsBoxLayoutState&) 	mozilla/layout/xul/base/src/nsBoxFrame.cpp:869
5 	nsBoxFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/xul/base/src/nsLeafBoxFrame.cpp:191
6 	nsFrame::ShrinkWidthToFit(nsIRenderingContext*, int) 	mozilla/layout/generic/nsFrame.cpp:3122
7 	nsContainerFrame::ComputeAutoSize(nsIRenderingContext*, nsSize, int, nsSize, nsSize, nsSize, int) 	mozilla/layout/generic/nsContainerFrame.cpp:680
8 	nsFrame::ComputeSize(nsIRenderingContext*, nsSize, int, nsSize, nsSize, nsSize, int) 	mozilla/layout/generic/nsFrame.cpp:2969
9 	nsHTMLReflowState::InitConstraints(nsPresContext*, int, int, nsMargin const*, nsMargin const*) 	mozilla/layout/generic/nsHTMLReflowState.cpp:1824
10 	nsHTMLReflowState::Init(nsPresContext*, int, int, nsMargin const*, nsMargin const*) 	mozilla/layout/generic/nsHTMLReflowState.cpp:315
etc...

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase2

Another testcase, also uses enhanced privileges, this crashes on reload.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Does it still crash with the patch for bug 403454?

Comment 3

[Martijn Wargers (dead)]

Yes, it still seems to crash with that patch (at least with the 2nd testcase).

Comment 4

[Martijn Wargers (dead)]

Attachment: testcase3

Comment 5

[Boris Zbarsky [:bzbarsky]]

I can't seem to reproduce with a debug trunk build on Mac.  Martijn, I assume you still see the crash on Windows with testcases 2 and 3?

Comment 6

[Martijn Wargers (dead)]

Yes, I still crash with the latest trunk build on windows with testcase 2 on reload and testcase 3.

Comment 7

[Mike Schroepfer]

Minusing unless you believe this is a topcrash or security concern^

Comment 8

[Martijn Wargers (dead)]

Actually, the regression range is when fullZoom was implemented, so I guess it's somehow caused by that.

Comment 9

[Martijn Wargers (dead)]

Attachment: testcase4

Comment 10

[Martijn Wargers (dead)]

Attachment: testcase5