451532 - Crash [@ nsLineList::begin][@ nsBlockInFlowLineIterator::Prev] with testcase3 of bug 401734

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Stack trace of current debug trunk build:
>	gklayout.dll!nsLineList::begin()  Line 1141 + 0x3 bytes	C++
 	gklayout.dll!nsBlockFrame::begin_lines()  Line 151 + 0x16 bytes	C++
 	gklayout.dll!nsBlockInFlowLineIterator::Prev()  Line 5194 + 0x2b bytes	C++
 	gklayout.dll!BuildTextRuns(gfxContext * aContext=0x0bea06c8, nsTextFrame * aForFrame=0x0be54ba8, nsIFrame * aLineContainer=0x0b980a00, const nsLineList_iterator * aForFrameLine=0x00000000)  Line 976 + 0x8 bytes	C++
 	gklayout.dll!nsTextFrame::EnsureTextRun(gfxContext * aReferenceContext=0x0bea06c8, nsIFrame * aLineContainer=0x00000000, const nsLineList_iterator * aLine=0x00000000, unsigned int * aFlowEndInTextRun=0x0012c19c)  Line 1871 + 0x1a bytes	C++
 	gklayout.dll!nsTextFrame::AddInlineMinWidthForFlow(nsIRenderingContext * aRenderingContext=0x0bf203d0, nsIFrame::InlineMinWidthData * aData=0x0012c27c)  Line 5261	C++
 	gklayout.dll!nsTextFrame::AddInlineMinWidth(nsIRenderingContext * aRenderingContext=0x0bf203d0, nsIFrame::InlineMinWidthData * aData=0x0012c27c)  Line 5364	C++
 	gklayout.dll!nsContainerFrame::DoInlineIntrinsicWidth(nsIRenderingContext * aRenderingContext=0x0bf203d0, nsIFrame::InlineIntrinsicWidthData * aData=0x0012c27c, nsLayoutUtils::IntrinsicWidthType aType=MIN_WIDTH)  Line 694	C++
 	gklayout.dll!nsFirstLetterFrame::AddInlineMinWidth(nsIRenderingContext * aRenderingContext=0x0bf203d0, nsIFrame::InlineMinWidthData * aData=0x0012c27c)  Line 150	C++
 	gklayout.dll!nsLayoutUtils::MinWidthFromInline(nsIFrame * aFrame=0x0be552e4, nsIRenderingContext * aRenderingContext=0x0bf203d0)  Line 2245	C++
 	gklayout.dll!nsFirstLetterFrame::GetMinWidth(nsIRenderingContext * aRenderingContext=0x0bf203d0)  Line 165 + 0xd bytes	C++
 	gklayout.dll!nsFrame::ShrinkWidthToFit(nsIRenderingContext * aRenderingContext=0x0bf203d0, int aWidthInCB=1020)  Line 3204 + 0x14 bytes	C++
 	gklayout.dll!nsContainerFrame::ComputeAutoSize(nsIRenderingContext * aRenderingContext=0x0bf203d0, nsSize aCBSize={...}, int aAvailableWidth=1020, nsSize aMargin={...}, nsSize aBorder={...}, nsSize aPadding={...}, int aShrinkWrap=1)  Line 735 + 0x10 bytes	C++
 	gklayout.dll!nsFrame::ComputeSize(nsIRenderingContext * aRenderingContext=0x0bf203d0, nsSize aCBSize={...}, int aAvailableWidth=1020, nsSize aMargin={...}, nsSize aBorder={...}, nsSize aPadding={...}, int aShrinkWrap=1)  Line 3052	C++
 	gklayout.dll!nsFirstLetterFrame::ComputeSize(nsIRenderingContext * aRenderingContext=0x0bf203d0, nsSize aCBSize={...}, int aAvailableWidth=1020, nsSize aMargin={...}, nsSize aBorder={...}, nsSize aPadding={...}, int aShrinkWrap=1)  Line 187 + 0x50 bytes	C++
 	gklayout.dll!nsHTMLReflowState::InitConstraints(nsPresContext * aPresContext=0x0c3f0c30, int aContainingBlockWidth=1020, int aContainingBlockHeight=1073741824, const nsMargin * aBorder=0x00000000, const nsMargin * aPadding=0x00000000)  Line 1816	C++
 	gklayout.dll!nsHTMLReflowState::Init(nsPresContext * aPresContext=0x0c3f0c30, int aContainingBlockWidth=-1, int aContainingBlockHeight=-1, const nsMargin * aBorder=0x00000000, const nsMargin * aPadding=0x00000000)  Line 290	C++
 	gklayout.dll!nsHTMLReflowState::nsHTMLReflowState(nsPresContext * aPresContext=0x0c3f0c30, const nsHTMLReflowState & aParentReflowState={...}, nsIFrame * aFrame=0x0be552e4, const nsSize & aAvailableSpace={...}, int aContainingBlockWidth=-1, int aContainingBlockHeight=-1, int aInit=1)  Line 179	C++
 	gklayout.dll!nsBlockFrame::ReflowFloat(nsBlockReflowState & aState={...}, nsPlaceholderFrame * aPlaceholder=0x0bd28df8, nsMargin & aFloatMargin={...}, unsigned int & aReflowStatus=0)  Line 5714	C++
 	gklayout.dll!nsBlockReflowState::FlowAndPlaceFloat(nsFloatCache * aFloatCache=0x0be3b820, int * aIsLeftFloat=0x0012c834, unsigned int & aReflowStatus=0, int aForceFit=1)  Line 798	C++
 	gklayout.dll!nsBlockReflowState::AddFloat(nsLineLayout & aLineLayout={...}, nsPlaceholderFrame * aPlaceholder=0x0bd28df8, int aInitialReflow=0, int aAvailableWidth=1020, unsigned int & aReflowStatus=0)  Line 597 + 0x18 bytes	C++
 	gklayout.dll!nsLineLayout::AddFloat(nsPlaceholderFrame * aFrame=0x0bd28df8, int aAvailableWidth=1020, unsigned int & aReflowStatus=0)  Line 232	C++
 	gklayout.dll!nsLineLayout::ReflowFrame(nsIFrame * aFrame=0x0bd28df8, unsigned int & aReflowStatus=0, nsHTMLReflowMetrics * aMetrics=0x00000000, int & aPushedFrame=0)  Line 898 + 0x1d bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, nsIFrame * aFrame=0x0bd28df8, LineReflowStatus * aLineReflowStatus=0x0012cb14)  Line 3585 + 0x16 bytes	C++
 	gklayout.dll!nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012cee0, LineReflowStatus * aLineReflowStatus=0x0012cc50, int aAllowPullUp=1)  Line 3408 + 0x20 bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012cee0)  Line 3257 + 0x2a bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012cee0)  Line 2323 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1904 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 962 + 0xf bytes	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0be5e3a0, nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=0, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 782 + 0x21 bytes	C++
 	gklayout.dll!nsColumnSetFrame::ReflowChildren(nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0, const nsColumnSetFrame::ReflowConfig & aConfig={...}, int aUnboundedLastColumn=1, nsCollapsingMargin * aBottomMarginCarriedOut=0x0012d6cc, nsColumnSetFrame::ColumnBalanceData & aColData={...})  Line 654	C++
 	gklayout.dll!nsColumnSetFrame::Reflow(nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 877 + 0x24 bytes	C++
 	gklayout.dll!nsBlockReflowContext::ReflowBlock(const nsRect & aSpace={...}, int aApplyTopMargin=0, nsCollapsingMargin & aPrevMargin={...}, int aClearance=0, int aIsAdjacentWithTop=1, nsLineBox * aLine=0x0be554e0, nsHTMLReflowState & aFrameRS={...}, unsigned int & aFrameReflowStatus=0, nsBlockReflowState & aState={...})  Line 310 + 0x2c bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012dd98)  Line 2996 + 0x48 bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012dd98)  Line 2268 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1904 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 962 + 0xf bytes	C++
 	gklayout.dll!nsBlockReflowContext::ReflowBlock(const nsRect & aSpace={...}, int aApplyTopMargin=1, nsCollapsingMargin & aPrevMargin={...}, int aClearance=0, int aIsAdjacentWithTop=1, nsLineBox * aLine=0x0be5e2cc, nsHTMLReflowState & aFrameRS={...}, unsigned int & aFrameReflowStatus=0, nsBlockReflowState & aState={...})  Line 310 + 0x2c bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012e904)  Line 2996 + 0x48 bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012e904)  Line 2268 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1904 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 962 + 0xf bytes	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0be5e0f4, nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=0, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 782 + 0x21 bytes	C++
 	gklayout.dll!CanvasFrame::Reflow(nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 572	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0be56b80, nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=3, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 782 + 0x21 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState * aState=0x0012f288, int aAssumeHScroll=0, int aAssumeVScroll=0, nsHTMLReflowMetrics * aMetrics=0x0012f1e4, int aFirstPass=1)  Line 517 + 0x30 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::ReflowContents(ScrollReflowState * aState=0x0012f288, const nsHTMLReflowMetrics & aDesiredSize={...})  Line 611 + 0x35 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::Reflow(nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 812 + 0x13 bytes	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0be56cbc, nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=0, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 782 + 0x21 bytes	C++
 	gklayout.dll!ViewportFrame::Reflow(nsPresContext * aPresContext=0x0c3f0c30, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 286 + 0x2d bytes	C++
 	gklayout.dll!PresShell::DoReflow(nsIFrame * target=0x0be56aec)  Line 6334	C++
 	gklayout.dll!PresShell::ProcessReflowCommands(int aInterruptible=1)  Line 6435	C++
 	gklayout.dll!PresShell::DoFlushPendingNotifications(mozFlushType aType=Flush_Layout, int aInterruptibleReflow=1)  Line 4589	C++
 	gklayout.dll!PresShell::ReflowEvent::Run()  Line 6192	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f848)  Line 511	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x01213ff8, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 170 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 181 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x012103e8, const nsXREAppData * aAppData=0x012108b8)  Line 3211 + 0x25 bytes	C++
 	firefox.exe!NS_internal_main(int argc=1, char * * argv=0x012103e8)  Line 158 + 0x12 bytes	C++
 	firefox.exe!wmain(int argc=1, unsigned short * * argv=0x003fa2f8)  Line 87 + 0xd bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 583 + 0x19 bytes	C
 	firefox.exe!wmainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

Comment 1

[Martijn Wargers (dead)]

The assertions that are firing before the crash:
###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlo
ck', file c:/mozilla-build-1.3/mozilla-central/layout/generic/nsBlockReflowState
.cpp, line 791
###!!! ASSERTION: aForFrame not found in block, someone lied to us: 'isValid', f
ile c:/mozilla-build-1.3/mozilla-central/layout/generic/nsTextFrameThebes.cpp, l
ine 949
###!!! ASSERTION: Someone lied to us about the block: 'backIterator.GetContainer
() == block', file c:/mozilla-build-1.3/mozilla-central/layout/generic/nsTextFra
meThebes.cpp, line 951

Comment 2

[Martijn Wargers (dead)]

Testcase4 of bug 401734 is crashing with the same stacktrace
https://bugzilla.mozilla.org/attachment.cgi?id=327669

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase2

Comment 4

[Martijn Wargers (dead)]

This seems to have regressed between 2008-06-23 and 2008-07-01. A more precise regression range might be useful.

Comment 5

[Daniel Holbert [:dholbert]]

Crashes my Linux mozilla-central debug build, as well.

Comment 6

[Daniel Holbert [:dholbert]]

(In reply to comment #5)
> Crashes my Linux mozilla-central debug build, as well.
(using the attached "testcase2")

Comment 7

[Bernd]

testcase 2 is wfm with a current debug build

Comment 8

[Martijn Wargers (dead)]

Yes, me too.