415323 - Crash [@ nsRuleNode::GetStyleBorder] with fullZoom and display: table, going back and going forth

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P4)

Description

[Martijn Wargers (dead)]

Attachment: testcase (uses enhanced privileges, need to download locally)

See testcase, which crashes in current trunk build with the following steps to reproduce:

- Load testcase
- Go to another url
- Go back

This started crashing between 2007-07-25 and 2007-07-26, this is when the full
zoom patch was checked in (bug 4821). Before that, the testcase doesn't crash
for obvious reasons.

http://crash-stats.mozilla.com/report/index/7a3f6d8a-d158-11dc-88c7-001a4bd43ed6
0  	nsRuleNode::GetStyleBorder(nsStyleContext*, int)  	 mozilla/layout/style/nsStyleStructList.h:134
1 	nsStyleContext::GetStyleBorder() 	mozilla/layout/style/nsStyleStructList.h:134
2 	nsHTMLReflowState::nsHTMLReflowState(nsPresContext*, nsHTMLReflowState const&, nsIFrame*, nsSize const&, int, int, int) 	mozilla/layout/generic/nsHTMLReflowState.cpp:177

This is perhaps the same bug as bug 398853.

Comment 1

[Bernd]

this wfm with my debug build it triggers some nasty assserts:

###!!! ASSERTION: cannot call GetUsedPadding on a dirty frame not currently bein
g reflowed: 'nsLayoutUtils::sDisableGetUsedXAssertions || !NS_SUBTREE_DIRTY(this
) || (GetStateBits() & NS_FRAME_IN_REFLOW)', file d:/moz_src/src/layout/generic/
nsFrame.cpp, line 637
###!!! ASSERTION: cannot call GetUsedBorder on a dirty frame not currently being
 reflowed: 'nsLayoutUtils::sDisableGetUsedXAssertions || !NS_SUBTREE_DIRTY(this)
 || (GetStateBits() & NS_FRAME_IN_REFLOW)', file d:/moz_src/src/layout/generic/n
sFrame.cpp, line 608
WARNING: getting z level of unregistered window: file d:/moz_src/src/xpfe/appshe
ll/src/nsWindowMediator.cpp, line 635
WARNING: getting z level of unregistered window: file d:/moz_src/src/xpfe/appshe
ll/src/nsWindowMediator.cpp, line 635
WARNING: Unable to test style tree integrity -- no content node: file d:/moz_src
/src/layout/base/nsCSSFrameConstructor.cpp, line 9883

Comment 2

[Martijn Wargers (dead)]

Yeah, the crash is gone.

I don't get those assertions in my tree, might be fixed by bug 459086 or something.