Crash [@ nsIFrame::GetStyleDisplay][@ nsPlaceholderFrame::AddInlinePrefWidth] with columns, float and doing stuff

RESOLVED WORKSFORME

Status

()

Core
Layout
P4
critical
RESOLVED WORKSFORME
11 years ago
7 years ago

People

(Reporter: Martijn Wargers (zombie), Unassigned)

Tracking

({crash, regression, testcase})

Trunk
x86
Windows XP
crash, regression, testcase
Points:
---
Bug Flags:
blocking1.9 -

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(4 attachments)

(Reporter)

Description

11 years ago
Created attachment 301893 [details]
testcase

I had this testcase laying around for some while. It might be that I already submitted this in a previous bug, but I couldn't find a similar looking stacktrace for this, so I'm submitting it now, to be sure it's covered.

The testcase crashes for me on current trunk build after 500ms.

http://crash-stats.mozilla.com/report/index/e818a099-d583-11dc-b117-001a4bd46e84
Frame  	Signature  	Source
0 	nsPlaceholderFrame::AddInlinePrefWidth(nsIRenderingContext*, nsIFrame::InlinePrefWidthData*) 	mozilla/layout/generic/nsPlaceholderFrame.cpp:105
1 	nsBlockFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/generic/nsBlockFrame.cpp:679
2 	nsColumnSetFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/generic/nsColumnSetFrame.cpp:347
3 	nsLayoutUtils::IntrinsicForContainer(nsIRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicWidthType) 	mozilla/layout/base/nsLayoutUtils.cpp:1475
4 	OneWidthToClearPastFloats 	mozilla/layout/generic/nsBlockFrame.cpp:6777
5 	nsBlockFrame::WidthToClearPastFloats(nsBlockReflowState&, nsIFrame*) 	mozilla/layout/generic/nsBlockFrame.cpp:6807
6 	nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) 	mozilla/layout/generic/nsBlockFrame.cpp:1789
7 	nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsBlockFrame.cpp:936
8 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:755
9 	CanvasFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsHTMLFrame.cpp:584
10 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:755
etc..

I can look for the regression range, if wanted.
(Reporter)

Comment 1

11 years ago
Created attachment 301894 [details]
stack from debug build
(Reporter)

Comment 2

11 years ago
Created attachment 302049 [details]
testcase2
(Reporter)

Comment 3

11 years ago
Created attachment 302051 [details]
testcase3

Slightly less reduced testcase. This gives the following assertion:
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file c:\mozilla-build\mozilla\layout\generic\nsPlaceholderFrame.h, line 175

and this crash:
	gklayout.dll!nsIFrame::GetStyleDisplay()  Line 95 + 0xa bytes	C++
 	gklayout.dll!DoDeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsVoidArray & aDestroyQueue={...}, nsIFrame * aRemovedFrame=0x04f00648, nsIFrame * aFrame=0x01392010)  Line 9340 + 0x8 bytes	C++
 	gklayout.dll!DoDeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsVoidArray & aDestroyQueue={...}, nsIFrame * aRemovedFrame=0x04f00648, nsIFrame * aFrame=0x04f00648)  Line 9324 + 0x15 bytes	C++
 	gklayout.dll!DeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsIFrame * aFrame=0x04f00648)  Line 9391 + 0x15 bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::ContentRemoved(nsIContent * aContainer=0x01fc24e0, nsIContent * aChild=0x04c445e8, int aIndexInContainer=3, int * aDidReconstruct=0x0012e00c)  Line 9595 + 0xd bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::RecreateFramesForContent(nsIContent * aContent=0x04c445e8)  Line 11242 + 0x1d bytes	C++
etc..
(Reporter)

Updated

11 years ago
Flags: blocking1.9?
Flags: blocking1.9? → blocking1.9+
Priority: -- → P4
Flags: wanted1.9.0.x+
Flags: blocking1.9-

Updated

10 years ago
Flags: tracking1.9+
(Reporter)

Updated

10 years ago
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → WORKSFORME
Flags: wanted1.9.0.x+ → wanted1.9.0.x?
This is WFM on the 1.9.0 branch as well
Flags: wanted1.9.0.x?
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsIFrame::GetStyleDisplay] [@ nsPlaceholderFrame::AddInlinePrefWidth]
You need to log in before you can comment on or make changes to this bug.