Closed Bug 416123 Opened 16 years ago Closed 16 years ago

Crash [@ nsIFrame::GetStyleDisplay][@ nsPlaceholderFrame::AddInlinePrefWidth] with columns, float and doing stuff

Categories

(Core :: Layout, defect, P4)

x86
Windows XP
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Unassigned)

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(4 files)

Attached file testcase
I had this testcase laying around for some while. It might be that I already submitted this in a previous bug, but I couldn't find a similar looking stacktrace for this, so I'm submitting it now, to be sure it's covered.

The testcase crashes for me on current trunk build after 500ms.

http://crash-stats.mozilla.com/report/index/e818a099-d583-11dc-b117-001a4bd46e84
Frame  	Signature  	Source
0 	nsPlaceholderFrame::AddInlinePrefWidth(nsIRenderingContext*, nsIFrame::InlinePrefWidthData*) 	mozilla/layout/generic/nsPlaceholderFrame.cpp:105
1 	nsBlockFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/generic/nsBlockFrame.cpp:679
2 	nsColumnSetFrame::GetMinWidth(nsIRenderingContext*) 	mozilla/layout/generic/nsColumnSetFrame.cpp:347
3 	nsLayoutUtils::IntrinsicForContainer(nsIRenderingContext*, nsIFrame*, nsLayoutUtils::IntrinsicWidthType) 	mozilla/layout/base/nsLayoutUtils.cpp:1475
4 	OneWidthToClearPastFloats 	mozilla/layout/generic/nsBlockFrame.cpp:6777
5 	nsBlockFrame::WidthToClearPastFloats(nsBlockReflowState&, nsIFrame*) 	mozilla/layout/generic/nsBlockFrame.cpp:6807
6 	nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) 	mozilla/layout/generic/nsBlockFrame.cpp:1789
7 	nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsBlockFrame.cpp:936
8 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:755
9 	CanvasFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	mozilla/layout/generic/nsHTMLFrame.cpp:584
10 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	mozilla/layout/generic/nsContainerFrame.cpp:755
etc..

I can look for the regression range, if wanted.
Attached file stack from debug build
Attached file testcase2
Attached file testcase3
Slightly less reduced testcase. This gives the following assertion:
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file c:\mozilla-build\mozilla\layout\generic\nsPlaceholderFrame.h, line 175

and this crash:
	gklayout.dll!nsIFrame::GetStyleDisplay()  Line 95 + 0xa bytes	C++
 	gklayout.dll!DoDeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsVoidArray & aDestroyQueue={...}, nsIFrame * aRemovedFrame=0x04f00648, nsIFrame * aFrame=0x01392010)  Line 9340 + 0x8 bytes	C++
 	gklayout.dll!DoDeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsVoidArray & aDestroyQueue={...}, nsIFrame * aRemovedFrame=0x04f00648, nsIFrame * aFrame=0x04f00648)  Line 9324 + 0x15 bytes	C++
 	gklayout.dll!DeletingFrameSubtree(nsFrameManager * aFrameManager=0x0139c56c, nsIFrame * aFrame=0x04f00648)  Line 9391 + 0x15 bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::ContentRemoved(nsIContent * aContainer=0x01fc24e0, nsIContent * aChild=0x04c445e8, int aIndexInContainer=3, int * aDidReconstruct=0x0012e00c)  Line 9595 + 0xd bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::RecreateFramesForContent(nsIContent * aContent=0x04c445e8)  Line 11242 + 0x1d bytes	C++
etc..
Flags: blocking1.9?
Flags: blocking1.9? → blocking1.9+
Priority: -- → P4
Flags: wanted1.9.0.x+
Flags: blocking1.9-
Flags: tracking1.9+
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
Flags: wanted1.9.0.x+ → wanted1.9.0.x?
This is WFM on the 1.9.0 branch as well
Flags: wanted1.9.0.x?
Crash Signature: [@ nsIFrame::GetStyleDisplay] [@ nsPlaceholderFrame::AddInlinePrefWidth]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: