460705 - Hang [@ nsBlockBandData::GetAvailableSpace] with float and large margins

Status: RESOLVED WORKSFORME

(Core :: Layout: Floats, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, I'm getting a hang with it in current trunk build and Firefox 3. I don't get a hang in Firefox 2.

Stack from debug build:
>	gklayout.dll!nsBlockBandData::GetAvailableSpace(int aY=12000, int aRelaxHeightConstraint=0, nsRect & aResult={...})  Line 93	C++
 	gklayout.dll!nsBlockReflowState::GetAvailableSpace(int aY=12000, int aRelaxHeightConstraint=0)  Line 354	C++
 	gklayout.dll!nsBlockReflowState::CanPlaceFloat(const nsSize & aFloatSize={...}, unsigned char aFloats='', int aForceFit=0)  Line 728	C++
 	gklayout.dll!nsBlockReflowState::FlowAndPlaceFloat(nsFloatCache * aFloatCache=0x0c1abb68, int * aIsLeftFloat=0x0012d690, unsigned int & aReflowStatus=0, int aForceFit=0)  Line 821 + 0x1a bytes	C++
 	gklayout.dll!nsBlockReflowState::AddFloat(nsLineLayout & aLineLayout={...}, nsPlaceholderFrame * aPlaceholder=0x0c1d6b18, int aInitialReflow=1, int aAvailableWidth=73440, unsigned int & aReflowStatus=0)  Line 597 + 0x18 bytes	C++
 	gklayout.dll!nsBlockReflowState::InitFloat(nsLineLayout & aLineLayout={...}, nsPlaceholderFrame * aPlaceholder=0x0c1d6b18, int aAvailableWidth=73440, unsigned int & aReflowStatus=0)  Line 545	C++
 	gklayout.dll!nsLineLayout::InitFloat(nsPlaceholderFrame * aFrame=0x0c1d6b18, int aAvailableWidth=73440, unsigned int & aReflowStatus=0)  Line 225	C++
 	gklayout.dll!nsLineLayout::ReflowFrame(nsIFrame * aFrame=0x0c1d6b18, unsigned int & aReflowStatus=0, nsHTMLReflowMetrics * aMetrics=0x00000000, int & aPushedFrame=0)  Line 895 + 0x1d bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, nsIFrame * aFrame=0x0c1d6b18, LineReflowStatus * aLineReflowStatus=0x0012d990)  Line 3569 + 0x16 bytes	C++
 	gklayout.dll!nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineLayout & aLineLayout={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012dd5c, LineReflowStatus * aLineReflowStatus=0x0012dacc, int aAllowPullUp=1)  Line 3392 + 0x20 bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012dd5c)  Line 3241 + 0x2a bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012dd5c)  Line 2307 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1888 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 946 + 0xf bytes	C++
 	gklayout.dll!nsBlockReflowContext::ReflowBlock(const nsRect & aSpace={...}, int aApplyTopMargin=1, nsCollapsingMargin & aPrevMargin={...}, int aClearance=0, int aIsAdjacentWithTop=1, nsLineBox * aLine=0x0c1d63c8, nsHTMLReflowState & aFrameRS={...}, unsigned int & aFrameReflowStatus=0, nsBlockReflowState & aState={...})  Line 310 + 0x2c bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012e8c8)  Line 2980 + 0x48 bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowLine(nsBlockReflowState & aState={...}, nsLineList_iterator aLine={...}, int * aKeepReflowGoing=0x0012e8c8)  Line 2252 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & aState={...})  Line 1888 + 0x1b bytes	C++
 	gklayout.dll!nsBlockFrame::Reflow(nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aMetrics={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 946 + 0xf bytes	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0c1d6194, nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=0, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 790 + 0x21 bytes	C++
 	gklayout.dll!CanvasFrame::Reflow(nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 674	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0c3a5db8, nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=3, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 790 + 0x21 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState * aState=0x0012f288, int aAssumeHScroll=0, int aAssumeVScroll=0, nsHTMLReflowMetrics * aMetrics=0x0012f1e4, int aFirstPass=1)  Line 528 + 0x30 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::ReflowContents(ScrollReflowState * aState=0x0012f288, const nsHTMLReflowMetrics & aDesiredSize={...})  Line 622 + 0x35 bytes	C++
 	gklayout.dll!nsHTMLScrollFrame::Reflow(nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 823 + 0x13 bytes	C++
 	gklayout.dll!nsContainerFrame::ReflowChild(nsIFrame * aKidFrame=0x0c3a5f34, nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, int aX=0, int aY=0, unsigned int aFlags=0, unsigned int & aStatus=0, nsOverflowContinuationTracker * aTracker=0x00000000)  Line 790 + 0x21 bytes	C++
 	gklayout.dll!ViewportFrame::Reflow(nsPresContext * aPresContext=0x0c099010, nsHTMLReflowMetrics & aDesiredSize={...}, const nsHTMLReflowState & aReflowState={...}, unsigned int & aStatus=0)  Line 283 + 0x2d bytes	C++
 	gklayout.dll!PresShell::DoReflow(nsIFrame * target=0x0c3a5c5c)  Line 6296	C++
 	gklayout.dll!PresShell::ProcessReflowCommands(int aInterruptible=1)  Line 6397	C++
 	gklayout.dll!PresShell::DoFlushPendingNotifications(mozFlushType aType=Flush_Layout, int aInterruptibleReflow=1)  Line 4559	C++
 	gklayout.dll!PresShell::ReflowEvent::Run()  Line 6154	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f848)  Line 511	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x012d3fe8, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 170 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 182 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x003fffe0, const nsXREAppData * aAppData=0x012d0880)  Line 3265 + 0x25 bytes	C++
 	firefox.exe!NS_internal_main(int argc=1, char * * argv=0x003fffe0)  Line 156 + 0x12 bytes	C++
 	firefox.exe!wmain(int argc=1, unsigned short * * argv=0x003fa2e8)  Line 87 + 0xd bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 583 + 0x19 bytes	C
 	firefox.exe!wmainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

Comment 1

[Martijn Wargers (dead)]

Btw, this might be related to bug 371885, perhaps.

Comment 2

[Jesse Ruderman]

Still hangs with the new float manager from bug 191448.

Comment 3

[Jesse Ruderman]

Attachment: testcase 2

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Well, the intent of the new float manager patch was to simplify code without changing behavior. :-P

Comment 5

[Jesse Ruderman]

These testcases no longer hang for me on Mac. But the first one trips:

###!!! ASSERTION: invalid call: '(aAscent != NS_UNCONSTRAINEDSIZE) && (aDescent != NS_UNCONSTRAINEDSIZE)', file /builds/slave/m-cen-m64-d-000000000000000000/build/src/layout/tables/nsTableRowFrame.cpp, line 500

(I'm guessing this is bug 391879.)

And the second one trips:

###!!! ASSERTION: Computed overflow area must contain frame bounds: 'aNewSize.width == 0 || aNewSize.height == 0 || r->width == nscoord_MAX || r->height == nscoord_MAX || (mState & NS_FRAME_SVG_LAYOUT) || r->Contains(nsRect(nsPoint(0,0), aNewSize))', file /builds/slave/m-cen-m64-d-000000000000000000/build/src/layout/generic/nsFrame.cpp, line 7673

(I split this out into bug 1222892.)