Crash [@ nsIFrame::GetProperty] with columns, position: absolute and visibility: collapse

RESOLVED WORKSFORME

Status

()

Core
Layout
--
critical
RESOLVED WORKSFORME
10 years ago
2 years ago

People

(Reporter: Martijn Wargers (dead), Unassigned)

Tracking

({crash, testcase})

Trunk
x86
All
crash, testcase
Points:
---
Bug Flags:
wanted1.9.1 +
wanted1.8.1.x -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

10 years ago
Created attachment 322997 [details]
testcase

See testcase, which crashes current trunk build after 500ms.

http://crash-stats.mozilla.com/report/index/4ce08319-2dcc-11dd-8d6a-0013211cbf8a?p=1
0  	xul.dll  	nsIFrame::GetProperty  	 mozilla/layout/generic/nsFrame.cpp:5762
1 	xul.dll 	nsIFrame::GetRelativeOffset 	mozilla/layout/generic/nsFrame.cpp:3716
2 	xul.dll 	nsLayoutUtils::CalculateContentBottom 	mozilla/layout/base/nsLayoutUtils.cpp:2445
3 	xul.dll 	nsColumnSetFrame::ReflowChildren 	mozilla/layout/generic/nsColumnSetFrame.cpp:585
4 	xul.dll 	nsColumnSetFrame::Reflow 	mozilla/layout/generic/nsColumnSetFrame.cpp:794
5 	xul.dll 	nsFrame::BoxReflow 	mozilla/layout/generic/nsFrame.cpp:6319
6 	xul.dll 	nsFrame::DoLayout 	mozilla/layout/generic/nsFrame.cpp:6108
7 	xul.dll 	nsBoxFrame::LayoutChildAt 	mozilla/layout/xul/base/src/nsBoxFrame.cpp:2023
8 	xul.dll 	nsSprocketLayout::Layout 	mozilla/layout/xul/base/src/nsSprocketLayout.cpp:211
9 	xul.dll 	nsBoxFrame::DoLayout 	mozilla/layout/xul/base/src/nsBoxFrame.cpp:946
10 	xul.dll 	nsIFrame::Layout 	mozilla/layout/xul/base/src/nsBox.cpp:561
11 	xul.dll 	nsStackLayout::Layout 	mozilla/layout/xul/base/src/nsStackLayout.cpp:288
12 	xul.dll 	nsBoxFrame::DoLayout 	mozilla/layout/xul/base/src/nsBoxFrame.cpp:946
13 	xul.dll 	nsIFrame::Layout 	mozilla/layout/xul/base/src/nsBox.cpp:561
14 	xul.dll 	nsBoxFrame::Reflow 	mozilla/layout/xul/base/src/nsBoxFrame.cpp:757
15 	xul.dll 	nsContainerFrame::ReflowChild 	mozilla/layout/generic/nsContainerFrame.cpp:771
16 	xul.dll 	ViewportFrame::Reflow 	mozilla/layout/generic/nsViewportFrame.cpp:286
17 	xul.dll 	PresShell::DoReflow 	mozilla/layout/base/nsPresShell.cpp:6280
18 	xul.dll 	PresShell::ProcessReflowCommands 	mozilla/layout/base/nsPresShell.cpp:6386
19 	xul.dll 	PresShell::DoFlushPendingNotifications 	mozilla/layout/base/nsPresShell.cpp:4574
20 	xul.dll 	PresShell::WillPaint 	mozilla/layout/base/nsPresShell.cpp:6006
21 	xul.dll 	xul.dll@0x2faff0 	
etc..
(Reporter)

Comment 2

10 years ago
Still crashes in current trunk build.
Flags: blocking1.9.1?
Flags: blocking1.9.1? → wanted1.9.1+
'testcase' crashes my Linux mozilla-central debug build, as well.
OS --> ALL
OS: Windows XP → All
(Reporter)

Comment 4

9 years ago
Still crashes in current trunk build.
Flags: blocking1.9.2?
Per comment 1 not a 1.8 problem.

Crashes my optimized Mac build, but not a windows debug build. I get scary assertions, though, so marking it [sg:critical?]. Multiple copies each of:

###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file c:/dev/fftrunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 822
WARNING: nsBlockFrame::CheckFloats: Explicit float list is out of sync with float cache: file c:/dev/fftrunk/mozilla/layout/generic/nsBlockFrame.cpp, line 6710
Flags: wanted1.8.1.x-
Whiteboard: [sg:critical?]
In a Linux debug build with my full patch queue, I'm not seeing a crash (although I do see some assertions).
(Reporter)

Comment 7

9 years ago
Yeah, I'm not seeing a crash either in current trunk build.
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → WORKSFORME
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsIFrame::GetProperty]

Updated

2 years ago
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.