Closed Bug 451355 Opened 12 years ago Closed 8 years ago

frame insert asserts with generated content, table, select, th and colgroup

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Assigned: bernd_mozilla)

References

Details

(Keywords: crash, regression, testcase)

Attachments

(1 file)

Attached file testcase
See testcase, wich crashes current trunk build.
It doesn't crash in a 2008-08-15 build, so I think this is a regression from bug 238072 somehow.

Stacktrace from debug build:
 	ntdll.dll!_DbgBreakPoint@0() 	
>	xpcom_core.dll!Break(const char * aMsg=0x0012ec6c)  Line 481	C++
 	xpcom_core.dll!NS_DebugBreak_P(unsigned int aSeverity=1, const char * aStr=0x0434fd7c, const char * aExpr=0x0434fd5c, const char * aFile=0x0434fd24, int aLine=2297)  Line 359 + 0xc bytes	C++
 	gklayout.dll!nsTableFrame::InsertFrames(nsIAtom * aListName=0x00000000, nsIFrame * aPrevFrame=0x00000000, nsIFrame * aFrameList=0x0e92a0b8)  Line 2297 + 0x28 bytes	C++
 	gklayout.dll!nsFrameManager::InsertFrames(nsIFrame * aParentFrame=0x0e91d60c, nsIAtom * aListName=0x00000000, nsIFrame * aPrevFrame=0x00000000, nsIFrame * aFrameList=0x0e92a0b8)  Line 680	C++
 	gklayout.dll!nsCSSFrameConstructor::AppendFrames(nsFrameConstructorState & aState={...}, nsIContent * aContainer=0x09b6ce00, nsIFrame * aParentFrame=0x0e91d60c, nsFrameItems & aFrameList={...}, nsIFrame * aAfterFrame=0x0e91d89c)  Line 7731 + 0x21 bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::ContentAppended(nsIContent * aContainer=0x09b6ce00, int aNewIndexInContainer=1)  Line 8508	C++
 	gklayout.dll!PresShell::ContentAppended(nsIDocument * aDocument=0x09a503a0, nsIContent * aContainer=0x09b6ce00, int aNewIndexInContainer=1)  Line 4716	C++
 	gklayout.dll!nsNodeUtils::ContentAppended(nsIContent * aContainer=0x09b6ce00, int aNewIndexInContainer=1)  Line 119 + 0xd7 bytes	C++
 	gklayout.dll!nsContentSink::NotifyAppend(nsIContent * aContainer=0x09b6ce00, unsigned int aStartIndex=1)  Line 1086 + 0xd bytes	C++
 	gklayout.dll!SinkContext::CloseContainer(nsHTMLTag aTag=eHTMLTag_table, int aMalformed=0)  Line 953	C++
 	gklayout.dll!HTMLContentSink::CloseContainer(nsHTMLTag aTag=eHTMLTag_table)  Line 2369 + 0x11 bytes	C++
 	gkparser.dll!CNavDTD::CloseContainer(nsHTMLTag aTag=eHTMLTag_table, int aMalformed=0)  Line 2780 + 0x26 bytes	C++
 	gkparser.dll!CNavDTD::CloseContainersTo(int anIndex=2, nsHTMLTag aTarget=eHTMLTag_table, int aClosedByStartTag=0)  Line 2828 + 0xe bytes	C++
 	gkparser.dll!CNavDTD::CloseContainersTo(nsHTMLTag aTag=eHTMLTag_table, int aClosedByStartTag=0)  Line 2972 + 0x14 bytes	C++
 	gkparser.dll!CNavDTD::DidBuildModel(unsigned int anErrorCode=0, int aNotifySink=1, nsIParser * aParser=0x08dcbc50, nsIContentSink * aSink=0x08dc871c)  Line 438 + 0x16 bytes	C++
 	gkparser.dll!nsParser::DidBuildModel(unsigned int anErrorCode=0)  Line 1004 + 0x35 bytes	C++
 	gkparser.dll!nsParser::ResumeParse(int allowIteration=1, int aIsFinalChunk=1, int aCanInterrupt=1)  Line 1713	C++
 	gkparser.dll!nsParser::OnStopRequest(nsIRequest * request=0x09bccbc0, nsISupports * aContext=0x00000000, unsigned int status=0)  Line 2337 + 0x17 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::OnStopRequest(nsIRequest * request=0x09bccbc0, nsISupports * aCtxt=0x00000000, unsigned int aStatus=0)  Line 324	C++
 	necko.dll!nsBaseChannel::OnStopRequest(nsIRequest * request=0x09d42ad8, nsISupports * ctxt=0x00000000, unsigned int status=0)  Line 623	C++
 	necko.dll!nsInputStreamPump::OnStateStop()  Line 577	C++
 	necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream * stream=0x08afe010)  Line 401 + 0xb bytes	C++
 	xpcom_core.dll!nsInputStreamReadyEvent::Run()  Line 112	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f848)  Line 511	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x003ff9b0, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 170 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 181 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x003fb1b8, const nsXREAppData * aAppData=0x003fb660)  Line 3209 + 0x25 bytes	C++
 	firefox.exe!NS_internal_main(int argc=1, char * * argv=0x003fb1b8)  Line 158 + 0x12 bytes	C++
 	firefox.exe!wmain(int argc=1, unsigned short * * argv=0x003f8bd0)  Line 87 + 0xd bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 583 + 0x19 bytes	C
 	firefox.exe!wmainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes
Flags: blocking1.9.1?
Flags: blocking1.9.1? → wanted1.9.1+
this doesnt crash anymore due to my fix for bug 456041

but it now throws a couple of interesting asserts that I added :-)

###!!! ASSERTION: heterogenous childlist: '(display->mDisplay == NS_STYLE_DISPLA
Y_TABLE_COLUMN_GROUP) == (nextDisplay->mDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN
_GROUP)', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line 2339
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792
stealing the bug for some debugging, Robert I guess you don't mind
Assignee: roc → bernd_mozilla
Severity: critical → normal
Summary: Crash [@ nsTableFrame::InsertFrames] with generated content, table, select, th and colgroup → frame insert asserts with generated content, table, select, th and colgroup
it doesn't assert anymore
If it doesn't assert any more we are going to close this? I see 2 crashes with nsTableFrame::InsertFrames on 7.0.1 and nothing on any over version in the past 4 weeks. Closing as won't fix.

Bernd, if you think this is still a valid issue, please reopen and help us figure out what the issue is.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WONTFIX
If it doesn't assert anymore, it should be resolved worksforme. I assume you checked that it doesn't assert anymore?
Status: RESOLVED → REOPENED
Resolution: WONTFIX → ---
I closed it because Bernd said it didn't assert anymore. He is the maintainer of the code right? I will take his word for it.
Status: REOPENED → RESOLVED
Closed: 8 years ago8 years ago
Resolution: --- → WORKSFORME
Well, I assume he would close this bug himself then.
Personally, I don't think it's good practice to close out a bug if it's not really known if the bug is really gone or not.
Using the latest (har har) SeaMonkey-Trunk Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111129 Firefox/11.0a1 SeaMonkey/2.8a1

there are no Errors coming up using the Testcase. Have tested also with FF 5.0, no crash, no errors. 

So I think we can left this Bug resolved as WFM for now. But for sure it was better to do some testing, before close others Bugs.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Sorry for the Spam, change again into Resoved -> Worksforme, have missed that before submitting.
Status: REOPENED → RESOLVED
Closed: 8 years ago8 years ago
Resolution: --- → WORKSFORME
the preferable way of handling this bug  would be 
1. to check in the testcase 
2. then mark the bug as testcase+
3. to mark it wfm
Flags: in-testsuite?
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.