416123 - Crash [@ nsIFrame::GetStyleDisplay][@ nsPlaceholderFrame::AddInlinePrefWidth] with columns, float and doing stuff

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P4)

Description

[Martijn Wargers (dead)]

Attachment: testcase

I had this testcase laying around for some while. It might be that I already submitted this in a previous bug, but I couldn't find a similar looking stacktrace for this, so I'm submitting it now, to be sure it's covered.

The testcase crashes for me on current trunk build after 500ms.

http://crash-stats.mozilla.com/report/index/e818a099-d583-11dc-b117-001a4bd46e84
Frame  	Signature  	Source
0 	nsPlaceholderFrame::AddInlinePrefWidth(nsIRenderingContext*, nsIFrame::InlinePrefWidthData*) 	mozilla/layout/generic/nsPlaceholderFrame.cpp:105
1 	nsBlockFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/generic/nsBlockFrame.cpp:679
2 	nsColumnSetFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/generic/nsColumnSetFrame.cpp:347
3 	nsLayoutUtils::IntrinsicForContainer(nsIRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicWidthType) 	mozilla/layout/base/nsLayoutUtils.cpp:1475
4 	OneWidthToClearPastFloats 	mozilla/layout/generic/nsBlockFrame.cpp:6777
5 	nsBlockFrame::WidthToClearPastFloats(nsBlockReflowState&, nsIFrame*) 	mozilla/layout/generic/nsBlockFrame.cpp:6807
6 	nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) 	mozilla/layout/generic/nsBlockFrame.cpp:1789
7 	nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsBlockFrame.cpp:936
8 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:755
9 	CanvasFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsHTMLFrame.cpp:584
10 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:755
etc..

I can look for the regression range, if wanted.

Comment 1

[Martijn Wargers (dead)]

Attachment: stack from debug build

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase2

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase3

Slightly less reduced testcase. This gives the following assertion:
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file c:\mozilla-build\mozilla\layout\generic\nsPlaceholderFrame.h, line 175

and this crash:
	gklayout.dll!nsIFrame::GetStyleDisplay()  Line 95 + 0xa bytes	C++
 	gklayout.dll!DoDeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsVoidArray & aDestroyQueue={...}, nsIFrame * aRemovedFrame=0x04f00648, nsIFrame * aFrame=0x01392010)  Line 9340 + 0x8 bytes	C++
 	gklayout.dll!DoDeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsVoidArray & aDestroyQueue={...}, nsIFrame * aRemovedFrame=0x04f00648, nsIFrame * aFrame=0x04f00648)  Line 9324 + 0x15 bytes	C++
 	gklayout.dll!DeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsIFrame * aFrame=0x04f00648)  Line 9391 + 0x15 bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::ContentRemoved(nsIContent * aContainer=0x01fc24e0, nsIContent * aChild=0x04c445e8, int aIndexInContainer=3, int * aDidReconstruct=0x0012e00c)  Line 9595 + 0xd bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::RecreateFramesForContent(nsIContent * aContent=0x04c445e8)  Line 11242 + 0x1d bytes	C++
etc..

Comment 4

[Daniel Veditz [:dveditz]]

This is WFM on the 1.9.0 branch as well