410198 - Crash with an absolutely positioned element inside a inline relative one [@ nsHTMLReflowState::GetNearestContainingBlock]

Status: RESOLVED FIXED

(Core :: Layout: Positioned, defect)

Description

[Bruno Fassino]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3pre) Gecko/2007122805 Minefield/3.0b3pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b3pre) Gecko/2007122805 Minefield/3.0b3pre

In some cases (depending on particular word wrapping and white space in source code) there is a crash on pages with an inline relatively positioned element containing an absolutely positioned one.


Reproducible: Always

Comment 1

[Bruno Fassino]

Attachment: minimal test case

An inline (gray background) relative element contains an absolutely positioned one (red background.)  If the browser window is slowly resized so that the inline element starts at the end of a line, there is usually a crash (in Windows XP.)
Addition of some white-space seems to fix the problem.

Comment 2

[Brian Polidoro]

Attachment: crash stack

Here's the crash report I got for this:
bp-de7e95de-b662-11dc-aee5-001a4bd43e5c

The first 14 frames look the same as Bug 398332. 

duplicate?

Comment 3

[Martijn Wargers (dead)]

Let's make it dependent on that bug and see whether the possible patch in that bug fixes this crash.

Comment 4

[Carsten Book [:Tomcat]]

Does not crash for me on RC1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008051206 Firefox/3.0 and also:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre)
Gecko/2008052816 Minefield/3.0pre and Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.5; en-US; rv:1.9pre) Gecko/2008052817 Firefox/3.0pre (Debug Builds with the Patch from Bug 398332 included) and the testcase.

Bruno, do you still see the crash on the Firefox 3RC1 Build ?

Comment 5

[Brian Polidoro]

The testcase no longer crashes with the latest build after today's checkin for bug 398332.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008052810 Minefield/3.0pre ID:2008052810

Comment 6

[philippe (part-time)]

On OS X 10.5.2
The test case crashes with
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9pre) Gecko/2008052704 Minefield/3.0pre

But the latest hourly from tinderbox no longer crashes (after the checking for bug 398332):
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9pre) Gecko/2008052816 Minefield/3.0pre

Comment 7

[Bruno Fassino]

Yes, it does not crash anymore with the nightly builds that I get now, both on XP:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008052901 Minefield/3.0pre

and on OS X:
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9pre) Gecko/2008052904 Minefield/3.0pre

I believe this can be changed to FIXED.

Comment 8

[Jeff Walden [:Waldo]]

Could people here create a simple page which crashes when it's loaded in one of the buggy builds but doesn't when loaded in one of the latest, non-crashy builds?  Good for making sure this never starts crashing again.

Comment 9

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2c77a201b78b

Comment 10

[Gregory Szorc [:gps]]

https://hg.mozilla.org/mozilla-central/rev/2c77a201b78b