416831 - Debug only crash [@ nsContinuingTextFrame::GetFirstContinuation] on first load with floating first-letter, bidi and image

Status: RESOLVED WORKSFORME

(Core :: Layout: Text and Fonts, defect, P4)

Description

[Martijn Wargers (dead)]

Attachment: testcase

Maybe related to bug 412243 or bug 414760?

The attached testcase crashes in my debug build, but not in a normal build (although I see content doubling there).

Stacktrace from debug build:
>	gklayout.dll!nsContinuingTextFrame::GetFirstContinuation()  Line 3252 + 0x3 bytes	C++
 	gklayout.dll!nsTextFrame::SetLength(int aLength=2)  Line 5196 + 0x10 bytes	C++
 	gklayout.dll!nsTextFrame::Reflow(nsPresContext * aPresContext=0x05ac5d38, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 5576	C++
 	gklayout.dll!nsLineLayout::ReflowFrame(nsIFrame * aFrame=0x05a68190, unsigned int & aReflowStatus=0, nsHTMLReflowMetrics * aMetrics=0x00000000, int & aPushedFrame=0)  Line 856 + 0x2d bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, nsIFrame * aFrame=0x05a68190, LineReflowStatus * aLineReflowStatus=0x0012ce2c)  Line 3586 + 0x16 bytes	C++
 	gklayout.dll!nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012d1f4, LineReflowStatus * aLineReflowStatus=0x0012cf60, int aAllowPullUp=1)  Line 3445 + 0x20 bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012d1f4)  Line 3257 + 0x2a bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012d1f4)  Line 2314 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1897 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x05ac5d38, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 936 + 0xf bytes	C++
 	gklayout.dll!nsBlockReflowContext::ReflowBlock(const nsRect & aSpace={...}, int aApplyTopMargin=0, nsCollapsingMargin & aPrevMargin={...}, int aClearance=0, int aIsAdjacentWithTop=1, nsMargin & aComputedOffsets={...}, nsLineBox * aLine=0x05a67db0, nsHTMLReflowState & aFrameRS={...}, unsigned int & aFrameReflowStatus=0, nsBlockReflowState & aState={...})  Line 339 + 0x2c bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012dd84)  Line 2996 + 0x4f bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012dd84)  Line 2260 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1897 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x05ac5d38, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 936 + 0xf bytes	C++
 	gklayout.dll!nsBlockReflowContext::ReflowBlock(const nsRect & aSpace={...}, int aApplyTopMargin=1, nsCollapsingMargin & aPrevMargin={...}, int aClearance=0, int aIsAdjacentWithTop=1, nsMargin & aComputedOffsets={...}, nsLineBox * aLine=0x05a677e4, nsHTMLReflowState & aFrameRS={...}, unsigned int & aFrameReflowStatus=0, nsBlockReflowState & aState={...})  Line 339 + 0x2c bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012e914)  Line 2996 + 0x4f bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012e914)  Line 2260 + 0x1b bytes	C++
etc..

Comment 1

[Uri Bernstein]

Floating first-letter and bidi don't mix well. See also bug 413085, bug 397187, bug 333961.

Comment 2

[Jesse Ruderman]

Before the crash, I see:

###!!! ASSERTION: How can an nsContinuingTextFrame be the first continuation?: 'previous', file /Users/jruderman/central/mozilla/layout/generic/nsTextFrameThebes.cpp, line 3397

Comment 3

[Bernd]

wfm with current debug build

Comment 4

[Martijn Wargers (dead)]

Ok, I guess it's fixed then.