451355 - frame insert asserts with generated content, table, select, th and colgroup

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, wich crashes current trunk build.
It doesn't crash in a 2008-08-15 build, so I think this is a regression from bug 238072 somehow.

Stacktrace from debug build:
 	ntdll.dll!_DbgBreakPoint@0() 	
>	xpcom_core.dll!Break(const char * aMsg=0x0012ec6c)  Line 481	C++
 	xpcom_core.dll!NS_DebugBreak_P(unsigned int aSeverity=1, const char * aStr=0x0434fd7c, const char * aExpr=0x0434fd5c, const char * aFile=0x0434fd24, int aLine=2297)  Line 359 + 0xc bytes	C++
 	gklayout.dll!nsTableFrame::InsertFrames(nsIAtom * aListName=0x00000000, nsIFrame * aPrevFrame=0x00000000, nsIFrame * aFrameList=0x0e92a0b8)  Line 2297 + 0x28 bytes	C++
 	gklayout.dll!nsFrameManager::InsertFrames(nsIFrame * aParentFrame=0x0e91d60c, nsIAtom * aListName=0x00000000, nsIFrame * aPrevFrame=0x00000000, nsIFrame * aFrameList=0x0e92a0b8)  Line 680	C++
 	gklayout.dll!nsCSSFrameConstructor::AppendFrames(nsFrameConstructorState & aState={...}, nsIContent * aContainer=0x09b6ce00, nsIFrame * aParentFrame=0x0e91d60c, nsFrameItems & aFrameList={...}, nsIFrame * aAfterFrame=0x0e91d89c)  Line 7731 + 0x21 bytes	C++
 	gklayout.dll!nsCSSFrameConstructor::ContentAppended(nsIContent * aContainer=0x09b6ce00, int aNewIndexInContainer=1)  Line 8508	C++
 	gklayout.dll!PresShell::ContentAppended(nsIDocument * aDocument=0x09a503a0, nsIContent * aContainer=0x09b6ce00, int aNewIndexInContainer=1)  Line 4716	C++
 	gklayout.dll!nsNodeUtils::ContentAppended(nsIContent * aContainer=0x09b6ce00, int aNewIndexInContainer=1)  Line 119 + 0xd7 bytes	C++
 	gklayout.dll!nsContentSink::NotifyAppend(nsIContent * aContainer=0x09b6ce00, unsigned int aStartIndex=1)  Line 1086 + 0xd bytes	C++
 	gklayout.dll!SinkContext::CloseContainer(nsHTMLTag aTag=eHTMLTag_table, int aMalformed=0)  Line 953	C++
 	gklayout.dll!HTMLContentSink::CloseContainer(nsHTMLTag aTag=eHTMLTag_table)  Line 2369 + 0x11 bytes	C++
 	gkparser.dll!CNavDTD::CloseContainer(nsHTMLTag aTag=eHTMLTag_table, int aMalformed=0)  Line 2780 + 0x26 bytes	C++
 	gkparser.dll!CNavDTD::CloseContainersTo(int anIndex=2, nsHTMLTag aTarget=eHTMLTag_table, int aClosedByStartTag=0)  Line 2828 + 0xe bytes	C++
 	gkparser.dll!CNavDTD::CloseContainersTo(nsHTMLTag aTag=eHTMLTag_table, int aClosedByStartTag=0)  Line 2972 + 0x14 bytes	C++
 	gkparser.dll!CNavDTD::DidBuildModel(unsigned int anErrorCode=0, int aNotifySink=1, nsIParser * aParser=0x08dcbc50, nsIContentSink * aSink=0x08dc871c)  Line 438 + 0x16 bytes	C++
 	gkparser.dll!nsParser::DidBuildModel(unsigned int anErrorCode=0)  Line 1004 + 0x35 bytes	C++
 	gkparser.dll!nsParser::ResumeParse(int allowIteration=1, int aIsFinalChunk=1, int aCanInterrupt=1)  Line 1713	C++
 	gkparser.dll!nsParser::OnStopRequest(nsIRequest * request=0x09bccbc0, nsISupports * aContext=0x00000000, unsigned int status=0)  Line 2337 + 0x17 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::OnStopRequest(nsIRequest * request=0x09bccbc0, nsISupports * aCtxt=0x00000000, unsigned int aStatus=0)  Line 324	C++
 	necko.dll!nsBaseChannel::OnStopRequest(nsIRequest * request=0x09d42ad8, nsISupports * ctxt=0x00000000, unsigned int status=0)  Line 623	C++
 	necko.dll!nsInputStreamPump::OnStateStop()  Line 577	C++
 	necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream * stream=0x08afe010)  Line 401 + 0xb bytes	C++
 	xpcom_core.dll!nsInputStreamReadyEvent::Run()  Line 112	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f848)  Line 511	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x003ff9b0, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 170 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 181 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x003fb1b8, const nsXREAppData * aAppData=0x003fb660)  Line 3209 + 0x25 bytes	C++
 	firefox.exe!NS_internal_main(int argc=1, char * * argv=0x003fb1b8)  Line 158 + 0x12 bytes	C++
 	firefox.exe!wmain(int argc=1, unsigned short * * argv=0x003f8bd0)  Line 87 + 0xd bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 583 + 0x19 bytes	C
 	firefox.exe!wmainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

Comment 1

[Bernd]

this doesnt crash anymore due to my fix for bug 456041

but it now throws a couple of interesting asserts that I added :-)

###!!! ASSERTION: heterogenous childlist: '(display->mDisplay == NS_STYLE_DISPLA
Y_TABLE_COLUMN_GROUP) == (nextDisplay->mDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN
_GROUP)', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line 2339
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792
###!!! ASSERTION: Non-row-group primary frame list child of an nsTableFrame?  Ho
w come?: 'Not Reached', file d:/moz_src/src/layout/tables/nsTableFrame.cpp, line
 2792

Comment 2

[Bernd]

stealing the bug for some debugging, Robert I guess you don't mind

Comment 3

[Bernd]

it doesn't assert anymore

Comment 4

[Sheila Mooney]

If it doesn't assert any more we are going to close this? I see 2 crashes with nsTableFrame::InsertFrames on 7.0.1 and nothing on any over version in the past 4 weeks. Closing as won't fix.

Bernd, if you think this is still a valid issue, please reopen and help us figure out what the issue is.

Comment 5

[Martijn Wargers (dead)]

If it doesn't assert anymore, it should be resolved worksforme. I assume you checked that it doesn't assert anymore?

Comment 6

[Sheila Mooney]

I closed it because Bernd said it didn't assert anymore. He is the maintainer of the code right? I will take his word for it.

Comment 7

[Martijn Wargers (dead)]

Well, I assume he would close this bug himself then.
Personally, I don't think it's good practice to close out a bug if it's not really known if the bug is really gone or not.

Comment 8

[Tobias Fischer]

Using the latest (har har) SeaMonkey-Trunk Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111129 Firefox/11.0a1 SeaMonkey/2.8a1

there are no Errors coming up using the Testcase. Have tested also with FF 5.0, no crash, no errors. 

So I think we can left this Bug resolved as WFM for now. But for sure it was better to do some testing, before close others Bugs.

Comment 9

[Tobias Fischer]

Sorry for the Spam, change again into Resoved -> Worksforme, have missed that before submitting.

Comment 10

[Bernd]

the preferable way of handling this bug  would be 
1. to check in the testcase 
2. then mark the bug as testcase+
3. to mark it wfm

Comment 11

[Bernd]

https://tbpl.mozilla.org/?tree=Try&rev=269764f20fb8

Comment 12

[Bernd]

https://tbpl.mozilla.org/?tree=Try&rev=7c85e4248441

Comment 13

[Bernd]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8c2950aa1144

Comment 14

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/8c2950aa1144