Last Comment Bug 480686 - "ABORT: comparing iterators over different lists" with -moz-column, rtl, background image
: "ABORT: comparing iterators over different lists" with -moz-column, rtl, back...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: All All
: P2 critical (vote)
: mozilla7
Assigned To: Boris Zbarsky [:bz] (still a bit busy)
:
: Jet Villegas (:jet)
Mentors:
Depends on:
Blocks: randomstyles 532972
  Show dependency treegraph
 
Reported: 2009-02-27 22:08 PST by Jesse Ruderman
Modified: 2011-06-27 02:18 PDT (History)
9 users (show)
bzbarsky: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (crashes debug Firefox when loaded) (309 bytes, text/html)
2009-02-27 22:08 PST, Jesse Ruderman
no flags Details
stack trace (27.66 KB, text/plain)
2009-02-27 22:09 PST, Jesse Ruderman
no flags Details
Fix (2.58 KB, patch)
2011-06-25 00:53 PDT, Boris Zbarsky [:bz] (still a bit busy)
no flags Details | Diff | Splinter Review
With a comment typo fixed (2.58 KB, patch)
2011-06-25 00:56 PDT, Boris Zbarsky [:bz] (still a bit busy)
roc: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2009-02-27 22:08:51 PST
Created attachment 364640 [details]
testcase (crashes debug Firefox when loaded)

###!!! ABORT: comparing iterators over different lists: 'mListLink == aOther.mListLink', file /Users/jruderman/central/layout/base/../generic/nsLineBox.h, line 684
Comment 1 Jesse Ruderman 2009-02-27 22:09:32 PST
Created attachment 364641 [details]
stack trace
Comment 2 Jesse Ruderman 2009-06-18 19:04:56 PDT
Still happens on mozilla-central.
Comment 3 Jesse Ruderman 2010-11-19 12:13:13 PST
Still aborts debug builds.  Seems harmless on opt.
Comment 4 Bob Clary [:bc:] 2011-04-19 21:19:53 PDT
I've seen this on whatwg for linux/mac at http://www.whatwg.org/specs/web-apps/current-work/

It is not reliable on this particular url, but spidering the anchors will almost always reproduce it.

http://www.whatwg.org/specs/web-apps/current-work/#attr-time-datetime
http://www.whatwg.org/specs/web-apps/current-work/#meta
http://www.whatwg.org/specs/web-apps/current-work/#the-canvas

The page appears to contain each of the elements of Jesse's test case.

The data from crash-stats for this url in April shows the related signatures: (counts are for the last week)

nsBulletFrame::GetListItemText 207 crashes (all Windows)

nsTextFrame::EnsureTextRun 107 crashes (most Windows, some Mac, Linux)

CompositeDataSourceImpl::cycleCollection::UnmarkPurple 3094 crashes (all Windows)
Comment 5 Boris Zbarsky [:bz] (still a bit busy) 2011-06-25 00:23:54 PDT
So what happens here is that nsCSSRendering::PaintBackgroundWithSC calls PrepareBackgroundLayer which calls InlineBackgroundData::GetContinuousRect, which calls IsOnSameLine for two frames that are in different columns, which fails the assertion.

Ideally we'd just check whether the two frames are in the same block, but that could be somewhat expensive....  I suppose we could check that just when the frames have different parents or something.
Comment 6 Boris Zbarsky [:bz] (still a bit busy) 2011-06-25 00:53:57 PDT
Created attachment 541901 [details] [diff] [review]
Fix
Comment 7 Boris Zbarsky [:bz] (still a bit busy) 2011-06-25 00:56:00 PDT
Created attachment 541902 [details] [diff] [review]
With a comment typo fixed
Comment 8 Robert O'Callahan (:roc) (email my personal email if necessary) 2011-06-25 02:34:42 PDT
Comment on attachment 541902 [details] [diff] [review]
With a comment typo fixed

Review of attachment 541902 [details] [diff] [review]:
-----------------------------------------------------------------
Comment 9 Boris Zbarsky [:bz] (still a bit busy) 2011-06-26 10:04:50 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/bba3ada5314c
Comment 10 Phil Ringnalda (:philor) 2011-06-26 13:23:27 PDT
Interesting effect on m-i. The crashtest.list was

asserts(6) load 479360-1.xhtml # Bug 439258
load 481806-1.html
asserts(6) load 483604-1.xhtml # Bug 439258

and when you inserted another one in between, 483604-1.xhtml stopped getting its expected 6 assertion failures, and 481806-1.html got 6 unexpected ones. Apparently that annotation on 479360-1.xhtml needs to be "asserts(6), forces-asserts-on-not-the-next-but-the-one-after-that(6)".
Comment 11 Mounir Lamouri (:mounir) 2011-06-26 15:02:49 PDT
(In reply to comment #9)
> http://hg.mozilla.org/integration/mozilla-inbound/rev/bba3ada5314c

Backed out due to perma-orange on the new test:
http://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=cfa057a48b48
Comment 12 Phil Ringnalda (:philor) 2011-06-26 15:12:06 PDT
s/perma-orange on the new test/perma-orange because a previous test, the harness, and|or editor is broken/
Comment 13 Boris Zbarsky [:bz] (still a bit busy) 2011-06-26 16:26:55 PDT
> Apparently that annotation on 479360-1.xhtml needs to be

I made that into a comment and rejiggered the annotations.  Then pushed this again as http://hg.mozilla.org/integration/mozilla-inbound/rev/062b3f071f81
Comment 14 Mounir Lamouri (:mounir) 2011-06-27 02:18:12 PDT
Merged:
http://hg.mozilla.org/mozilla-central/rev/062b3f071f81

Note You need to log in before you can comment on or make changes to this bug.