444027 - Crash with iExploder test 40129979 [@ BuildTextRunsScanner::FindBoundaries]

Status: VERIFIED FIXED

(Core :: Layout: Block and Inline, defect, P3)

Description

[Mats Palmgren (inactive)]

Followup from bug 421671.

Both testcases in bug 421671 still generates many assertions and
finally aborts at "running past end":
http://hg.mozilla.org/mozilla-central/index.cgi/file/ee8961927fb4/layout/generic/nsLineBox.h#l611


Here's an up-to-date list of assertions on Linux:

Doing nscoord addition with values > nscoord_MAX: 'a < nscoord_MAX && b < nscoord_MAX', file ../../dist/include/gfx/nsCoord.h, line 150

comparing iterators over different lists: 'mListLink == aOther.mListLink', layout/base/../generic/nsLineBox.h, line 690

no unconstrained widths should be present anymore: 'NS_UNCONSTRAINEDSIZE != aReflowState.ComputedWidth()', layout/generic/nsBlockReflowState.cpp, line 113

should no longer be using unconstrained sizes: 'aRightEdge != NS_UNCONSTRAINEDSIZE', layout/generic/nsLineLayout.cpp, line 411

should no longer be using unconstrained widths: 'aWidth != NS_UNCONSTRAINEDSIZE', layout/generic/nsLineLayout.cpp, line 178

should no longer use available widths: 'availableWidth != NS_UNCONSTRAINEDSIZE', layout/generic/nsInlineFrame.cpp, line 428

shouldn't have unconstrained widths anymore: 'NS_UNCONSTRAINEDSIZE != aReflowState.availableWidth', layout/generic/nsLineLayout.cpp, line 1087

shouldn't have unconstrained widths anymore: 'psd->mRightEdge != NS_UNCONSTRAINEDSIZE', layout/generic/nsLineLayout.cpp, line 2404

shouldn't have unconstrained widths anymore: 'psd->mRightEdge != NS_UNCONSTRAINEDSIZE', layout/generic/nsLineLayout.cpp, line 782

shouldn't use unconstrained widths anymore: '(mFrameType == NS_CSS_FRAME_TYPE_INLINE && !frame->IsFrameOfType(nsIFrame::eReplaced)) || frame->GetType() == nsGkAtoms::textFrame || mComputedWidth != NS_UNCONSTRAINEDSIZE', layout/generic/nsHTMLReflowState.cpp, line 315

shouldn't use unconstrained widths anymore: 'availableWidth != NS_UNCONSTRAINEDSIZE', layout/generic/nsHTMLReflowState.cpp, line 294

this shouldn't happen anymore: 'NS_UNCONSTRAINEDSIZE != aComputedWidth && NS_UNCONSTRAINEDSIZE != aAvailWidth', layout/generic/nsHTMLReflowState.cpp, line 1926

unconstrained available width in reflow: 'NS_UNCONSTRAINEDSIZE != aAvailSpace.width', layout/tables/nsTableRowFrame.cpp, line 74

unconstrained widths no longer supported: 'aContainingBlockWidth != NS_UNCONSTRAINEDSIZE', layout/base/nsLayoutUtils.cpp, line 1879

bad width: 'Not Reached', layout/generic/nsLineLayout.cpp, line 181

comparing iterators over different lists: 'mListLink == aOther.mListLink', layout/base/../generic/nsLineBox.h, line 690

Comment 1

[Jesse Ruderman]

"running past end" is really bad.

Comment 2

[Samuel Sidler (old account; do not CC)]

Not blocking, but wanted.

Comment 3

[Mats Palmgren (inactive)]

I have a fix for this in my tree...

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Mats, any chance you could post that fix?  Or are you saying that it's fixed by the fix for some other bug that you have in your tree and you don't know which?

Comment 5

[Mats Palmgren (inactive)]

Attachment: Frame dump

Comment 6

[Mats Palmgren (inactive)]

Attachment: Patch rev. 1

InlineIntrinsicWidthData::line needs to be updated if the continuation
is within a new line container.

This patch makes us trigger:
ASSERTION: Wrong line container hint: '!aForFrame || aLineContainer == FindLineContainer(aForFrame)'
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsTextFrameThebes.cpp?mark=969#959

for floating first-letter frames because nsLineLayout's line container:
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsLineLayout.h?mark=366#361

disagree with FindLineContainer():
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsTextFrameThebes.cpp#776

I muted that case for now, I think we can fix it separately.

Comment 7

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/a303089722f1

(holding the crashtests until 1.9.1/1.9.0 is fixed)

-> FIXED

Comment 8

[Mats Palmgren (inactive)]

(Filed follow-up bug 477781 on the line container disagreement)

Comment 9

[Jesse Ruderman]

This bug is public, so I see no need to hold the crashtests.

Comment 10

[Mats Palmgren (inactive)]

Ok, I thought bug 421671 (where the tests are) was hidden... anyway, the
iExploder bugs probably doesn't need to be hidden at all since the
test suite is public.

FWIW, I have now run iExploder test 1 to 30000 on MacOSX and the only
crash I encountered was bug 477775.

Pushed the crashtest:
http://hg.mozilla.org/mozilla-central/rev/4233c31e67d8

Comment 11

[Mats Palmgren (inactive)]

Comment on attachment 361176 [details] [diff] [review]
Patch rev. 1

This fixes a nasty crash. Asking for approval together with bug 477928.

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 361176 [details] [diff] [review]
Patch rev. 1

Approved for 1.8.1.21, a=dveditz for release-drivers

Comment 13

[Daniel Veditz [:dveditz]]

sorry, wrong paste buffer
Approved for 1.9.0.8, a=dveditz for release-drivers (as the flag says).

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 361176 [details] [diff] [review]
Patch rev. 1

a1.9.1=dbaron, but it must land along with bug 477928

Comment 15

[Mats Palmgren (inactive)]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/8fed6a0625ce
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/39460eaf5d06
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/ce70e94d5e1c

Comment 16

[Mats Palmgren (inactive)]

mozilla/layout/generic/nsBlockFrame.cpp 	3.960
mozilla/layout/generic/nsIFrame.h 	3.405
mozilla/layout/generic/nsLineBox.h 	1.98
mozilla/layout/generic/nsTextFrameThebes.cpp 	3.188 
mozilla/layout/generic/crashtests/421671.html 	1.1
mozilla/layout/generic/crashtests/crashtests.list 	1.122

Comment 17

[Al Billings [:abillings - ex-MoCo]]

Verified with 1.9.0.8 using crashtest checked in.

Comment 18

[Aakash Desai [:aakashd]]

verified FIXED on builds: 
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090428 Minefield/3.6a1pre ID:20090428031037

and

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b5pre) Gecko/20090427 Shiretoko/3.5b5pre ID:20090427031112