470272 - Crash [@ DeletingFrameSubtree] with -moz-column-count, float, position: fixed and generated content

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P2)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build after 200 ms. It doesn't crash in a  2008-12-07 build, it does crash in a 2008-12-08 build:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2008-12-07+04%3A00%3A00&enddate=2008-12-08+06%3A00%3A00
Regression from bug 465913 is my guess.

http://crash-stats.mozilla.com/report/index/8dfd28a7-754a-47bd-b3cc-d38a92081218?p=1
0  	 	@0x2964384  	
1 	xul.dll 	DeletingFrameSubtree 	layout/base/nsCSSFrameConstructor.cpp:9276
2 	xul.dll 	nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal 	layout/base/nsCSSFrameConstructor.cpp:7608
3 	xul.dll 	xul.dll@0x317f55 	
4 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	layout/base/nsCSSFrameConstructor.cpp:9876
5 	xul.dll 	nsCSSFrameConstructor::RestyleElement 	layout/base/nsCSSFrameConstructor.cpp:9950
6 	xul.dll 	nsCSSFrameConstructor::ProcessOneRestyle 	layout/base/nsCSSFrameConstructor.cpp:13361
7 	xul.dll 	nsCSSFrameConstructor::ProcessPendingRestyles 	layout/base/nsCSSFrameConstructor.cpp:13458
8 	xul.dll 	PresShell::DoFlushPendingNotifications 	layout/base/nsPresShell.cpp:4562
9 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4521
10 	xul.dll 	nsCSSFrameConstructor::RestyleEvent::Run 	layout/base/nsCSSFrameConstructor.cpp:13543
11 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
12 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
13 	nspr4.dll 	PR_GetEnv 	
14 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:87
15 	firefox.exe 	firefox.exe@0x2197 	
16 	kernel32.dll 	BaseProcessStart

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Oops, I removed just a little bit too much with the previous testcase.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This testcase is even more crazy than usual. But I think it's basically like bug 470978, we're traversing the same frames multiple times in DoDeletingFrameSubtree. Fixing that should fix this.

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase2

I guess this is the same crash, this has breakpad stacktrace:
http://crash-stats.mozilla.com/report/index/e6242fa4-d1bd-44db-9b36-d788a2090106?p=1
0  	 	@0x1380b5f  	
1 	xul.dll 	nsFrameManager::RemoveFrame 	layout/base/nsFrameManager.cpp:706
2 	xul.dll 	DeletingFrameSubtree 	layout/base/nsCSSFrameConstructor.cpp:9296
3 	xul.dll 	nsCSSFrameConstructor::ContentRemoved 	layout/base/nsCSSFrameConstructor.cpp:9485
4 	xul.dll 	nsCSSFrameConstructor::ReinsertContent 	layout/base/nsCSSFrameConstructor.cpp:9119
5 	xul.dll 	nsCSSFrameConstructor::ReframeContainingBlock 	layout/base/nsCSSFrameConstructor.cpp:13069
6 	xul.dll 	xul.dll@0x2a0574 	
7 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	layout/base/nsCSSFrameConstructor.cpp:9896
8 	xul.dll 	nsCSSFrameConstructor::RestyleElement 	layout/base/nsCSSFrameConstructor.cpp:9970
9 	xul.dll 	nsCSSFrameConstructor::ProcessOneRestyle 	layout/base/nsCSSFrameConstructor.cpp:13383
10 	xul.dll 	nsCSSFrameConstructor::ProcessPendingRestyles 	layout/base/nsCSSFrameConstructor.cpp:13489
11 	xul.dll 	PresShell::DoFlushPendingNotifications 	layout/base/nsPresShell.cpp:4504
12 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4462
13 	xul.dll 	nsCSSFrameConstructor::RestyleEvent::Run 	layout/base/nsCSSFrameConstructor.cpp:13574
14 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
15 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
16 	nspr4.dll 	PR_GetEnv 	
17 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:87
18 	firefox.exe 	firefox.exe@0x2197 	
19 	kernel32.dll 	BaseProcessStart

Comment 4

[Daniel Holbert [:dholbert]]

(In reply to comment #2)
> I think it's basically like
> bug 470978, we're traversing the same frames multiple times in
> DoDeletingFrameSubtree. Fixing that should fix this.

I can confirm that the reviewed "patch v3" on bug 470978 fixes the crashes on both of this bug's testcases.

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Taking off the blocker list, we don't need 465913 in 1.9.1.

Comment 6

[Bernd]

this is wfm with current trunk?

Comment 7

[Nochum Sossonko [:Natch]]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20090321 Minefield/3.6a1pre

->WORKSFORME

Comment 8

[Mats Palmgren (inactive)]

crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7882ee3415b3

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7882ee3415b3