417902 - "ASSERTION: Float frame has wrong parent" with -moz-column, floating first-letter

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 752

Comment 1

[Boris Zbarsky [:bzbarsky]]

This is kind of fun.  At the entry point to nsCSSFrameConstructor::ContentAppended we have:

Block(body)(1)@0xb3a51398 next=0xb3a51d04 next-in-flow=0xb3a51d04 {0,0,145
20100000] sc=0xb3a512f8(i=1,b=0) pst=:-moz-column-content<
  line 0xb3a518f0: count=2 state=inline,clean,prevmarginclean,not impacted
ore:nobr,after:nobr[0x8100] {0,0,0,0} ca={14040,0,480,420} <
    Placeholder(body)(1)@0xb3a518b8 {0,0,0,0} outOfFlowFrame=Letter(body)(

    Text(0)@0xb3a51874[1,1,T]  prev-continuation=0xb3a51640 {0,0,0,0} [sta
ECTED [content=0xb3a47490] sc=0xb3a51348 pst=:-moz-non-element<
      " "
    >
  > floats <
    placeholder@0xb3a518b8 Letter(body)(1) region={14040,0,480,420}
  >
  Float-list<
    Letter(body)(1)@0xb3a5181c {14040,0,480,420} [state=00000100] [content
=0xb3a51720] pst=:first-letter<
      Text(0)@0xb3a51640[0,1,F]  next-continuation=0xb3a51874 {0,0,480,420
0] SELECTED [content=0xb3a47490] sc=0xb3a517cc pst=:-moz-non-element<
        "x"
      >
    >
  >
>
Block(body)(1)@0xb3a51d04 prev-in-flow=0xb3a51398 {15480,0,14520,1380} [st
verflow=0,0,24000,1380] sc=0xb3a512f8(i=1,b=0) pst=:-moz-column-content<
  line 0xb3a51ca8: count=1 state=inline,clean,prevmarginclean,not impacted
ore:nobr,after:nobr[0x4100] {0,0,24000,1380} <
    Inline(span)(1)@0xb3a5157c {0,0,24000,1380} [content=0xb3889f38] [sc=0

  >
>

At the point when we return from this function, on the other hand, we have:

Block(body)(1)@0xb3a51398 next=0xb3a51d04 next-in-flow=0xb3a51d04 {0,0,14520,1380} [state=20101000] sc=0xb3a512f8(i=1,b=0) pst=:-moz-column-content<
  line 0xb3a518f0: count=2 state=inline,dirty,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x8041] {0,0,0,0} <
    Placeholder(body)(1)@0xb3a5a41c {0,0,0,0} [state=00000402] outOfFlowFrame=Letter(body)(1)@0xb3a51770
    Text(0)@0xb3a51874[0,2,T]  prev-continuation=0xb3a51640 {0,0,0,0} [state=00000406] [content=0xb3a47490] sc=0xb3865ab4 pst=:-moz-non-element<
      "x "
    >
  >
>
Block(body)(1)@0xb3a51d04 prev-in-flow=0xb3a51398 {15480,0,14520,1380} [state=2010100c] [overflow=0,0,24000,1380] sc=0xb3a512f8(i=1,b=0) pst=:-moz-column-content<
  line 0xb3a51ca8: count=1 state=inline,dirty,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x4141] {0,0,24000,1380} <
    Inline(span)(1)@0xb3a5157c {0,0,24000,1380} [state=00000400] [content=0xb3889f38] [sc=0xb3a516a8]<
      Inline(span)(0)@0xb3a518b8 {0,0,0,0} [state=00000402] [content=0xb3a4dde0] [sc=0xb3a51348]<>
    >
  >
  Float-list<
    Letter(body)(1)@0xb3a51770 {0,0,0,0} [state=00000502] [content=0xb3a6e9d8] [sc=0xb3a51720] pst=:first-letter<
      Text(0)@0xb3a51640[0,0,F]  next-continuation=0xb3a51874 {0,0,0,0} [state=00000402] [content=0xb3a47490] sc=0xb3a517cc pst=:-moz-non-element<
        ""
      >
    >
  >
>

The problem is that when we RecoverLetterFrames we end up putting the floating first-letter frame in the float list on the frame constructor state, which is the wrong float list in this case (it corresponds to the second block, whereas the first-letter should really go into the float list of the first block).

Comment 2

[Daniel Holbert [:dholbert]]

Attachment: testcase 2 (crashes firefox when loaded)

Here's another testcase, based on bug 425981's testcase, that triggers this bug's assertion *plus* a crash.  It triggers this series of assertions just before the crash:

###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /mozilla/layout/generic/nsBlockReflowState.cpp, line 791
###!!! ASSERTION: aForFrame not found in block, someone lied to us: 'isValid', file /mozilla/layout/generic/nsTextFrameThebes.cpp, line 949
###!!! ASSERTION: Someone lied to us about the block: 'backIterator.GetContainer() == block', file /mozilla/layout/generic/nsTextFrameThebes.cpp, line 951

Comment 3

[Daniel Holbert [:dholbert]]

Actually -- the original testcase on this bug triggers those same assertions & the crash for me, too.

I'm using a mozilla-central debug build from yesterday.

Comment 4

[Daniel Holbert [:dholbert]]

I no longer crash on either of this bug's testcases, using an up-to-date mozilla-central debug build. I also no longer get the final assertion mentioned in comment 2 ("Someone lied to us about the block...").

Instead, on both testcases, I now get two copies of the following warning on pageload, and another copy each time I horizontally resize the window:
  WARNING: nsBlockFrame::CheckFloats: Explicit float list is out of sync with float cache: file /mozilla/layout/generic/nsBlockFrame.cpp, line 6755

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

That's pretty bad actually ... can probably lead to a crash somehow or other.

Comment 6

[Jesse Ruderman]

If it's that bad, it should at least be an assertion rather than a warning :/

Comment 7

[Jesse Ruderman]

The testcase is entirely WFM now.  Filed bug 499229 for comment 6.

Comment 8

[Jesse Ruderman]

I'll add both testcases as crashtests

Comment 9

[Jesse Ruderman]

Crashtests added:

http://hg.mozilla.org/mozilla-central/rev/aad5b1c64ed4