411870 - "ASSERTION: running past end" with -moz-column, direction:rtl

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase triggers:

###!!! ASSERTION: running past end: 'mCurrent != mListLink', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsLineBox.h, line 621

I think this assertion usually leads to a crash.  I don't know whether it does for this testcase, because I have it set to abort.

Comment 1

[Daniel Veditz [:dveditz]]

Is this a mac-only crash? I see the assertion on trunk windows but don't crash (nor do I crash in an opt build).

Don't crash or assert in 1.8.1.12 builds. Since the assert is from 2001 I assume that means we don't have the problem on the 1.8 branch.

Comment 2

[Jesse Ruderman]

If I turn off the abort, it actually doesn't crash for me.  I tried reloading a bunch of times (in case there was random memory corruption), and didn't see any bad stuff happen.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

It's bad though.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Stack:

#0  NS_DebugBreak_P (aSeverity=1, aStr=0x13e59f50 "running past end", aExpr=0x13e59f38 "mCurrent != mListLink", aFile=0x13e59efc "/Users/roc/mozilla-trunk/layout/base/../generic/nsLineBox.h", aLine=620) at /Users/roc/mozilla-trunk/xpcom/base/nsDebugImpl.cpp:263
#1  0x13ee8d39 in nsLineList_iterator::operator-> (this=0xbfffae74) at /Users/roc/mozilla-trunk/layout/base/../generic/nsLineBox.h:620
#2  0x1380caa7 in nsBidiPresUtils::Resolve (this=0x3f7d7800, aBlockFrame=0x27972c4, aIsVisualFormControl=0) at /Users/roc/mozilla-trunk/layout/base/nsBidiPresUtils.cpp:442
#3  0x138215b8 in nsBlockFrame::ResolveBidi (this=0x27972c4) at /Users/roc/mozilla-trunk/layout/generic/nsBlockFrame.cpp:6745

Relevant frame tree:

          ColumnSet(body)(3)@0x2796f88 next=0x27974e8 {480,480,56400,1152} [state=00001021] [content=0x249ece0] [sc=0x2796fc8]<
            Block(body)(3)@0x27970c0 next=0x2797998 next-in-flow=0x2797998 {56399,0,1,1152} [state=08001001] sc=0x2797020(i=0,b=1) pst=:-moz-column-content<
              line 0x27974c0: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4048] {0,0,1,1152} <
                Block(div)(0)@0x27972c4 next-in-flow=0x2797918 {0,0,1,1152} [state=00001001] sc=0x2797070(i=0,b=0)<
                >
              >
            >
            Block(body)(3)@0x2797998 next=0x2797a70 prev-in-flow=0x27970c0 next-in-flow=0x2797a70 {961,0,1,1152} [state=00000004] sc=0x2797020(i=0,b=1) pst=:-moz-column-content<
              line 0x2797970: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4008] {0,0,1,1152} <
                Block(div)(0)@0x2797918 prev-in-flow=0x27972c4 next-in-flow=0x27979f0 {0,0,1,1152} [state=00000004] sc=0x2797070(i=1,b=0)<
                  line 0x2797884: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:linebr[0x5100] {1,0,0,1152} <
                    Text(0)@0x2797458[0,1,F]  next-continuation=0x27978ac {1,96,0,960} [state=00620000] [content=0x24ebb68] sc=0x2797408 pst=:-moz-non-element<
                      "\n"
                    >
                  >
                >
              >
            >
            Block(body)(3)@0x2797a70 prev-in-flow=0x2797998 {0,0,1,1152} [state=00001004] sc=0x2797020(i=1,b=1) pst=:-moz-column-content<
              line 0x2797a48: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4008] {0,0,1,1152} <
                Block(div)(0)@0x27979f0 next=0x2797380 prev-in-flow=0x2797918 {0,0,1,1152} [state=00000004] sc=0x2797070(i=1,b=0)<
                  line 0x27978f0: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:linebr[0x5100] {1,0,0,1152} <
                    Text(0)@0x27978ac[1,1,T]  prev-continuation=0x2797458 {1,96,0,960} [state=00620004] [content=0x24ebb68] sc=0x2797408 pst=:-moz-non-element<
                      "\n"
                    >
                  >
                >
              >
              line 0x2797498: count=1 state=inline,dirty,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4001] {0,0,0,0} <
                Inline(span)(1)@0x2797380 {0,0,0,0} [state=00000402] [content=0x24ebaf8] [sc=0x2797330]<
                  Text(0)@0x2797260[0,1,T]  {0,0,0,0} [state=00020402] [content=0x24ebb20] sc=0x27973b8 pst=:-moz-non-element<
                    "\n"
                  >
                >
              >
            >
          >
        >
        

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

Unless I'm missing something, this line-tracking code doesn't work at all across block continuations. This makes it use nsBlockInFlowLineIterator.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

checked in with test.

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I had to back this out, it caused layout/generic/test/test_bug384527.html to crash.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

This fixes the regression. Our loop in AdvanceLineIteratorToFrame that was supposed to find the nearest ancestor of aFrame that's a direct child of the block was failing --- the IsFrameOfType(eLineParticipant) test was returning false for a floated first-letter frame. I changed the check to call nsLayoutUtils::GetAsBlock so we stop when our parent is a genuine nsBlockFrame. I'll reland with this.

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Relanded.

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Backed out again, crashed in layout/generic/test/test_bug389630.html this time

Comment 11

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix v3

We actually need to walk up following floats to their placeholders here.

Comment 12

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I ran Mochitests with this and we don't crash anymore.

Comment 13

[Jesse Ruderman]

Run reftests and crashtests too, please?

Comment 14

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Did that and they passed

Comment 15

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Checked in a third time!