Hang [@ nsBlockFrame::ReflowInlineFrames] with removing 𐶅 and small width

RESOLVED FIXED

Status

()

Core
Layout
P2
critical
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: smontagu)

Tracking

(4 keywords)

unspecified
x86
Mac OS X
hang, regression, verified1.9.1, verified1.9.2
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9.2 +
in-testsuite +

Firefox Tracking Flags

(status1.9.2 beta1-fixed, status1.9.1 .6-fixed)

Details

Attachments

(2 attachments)

(Reporter)

Description

8 years ago
Created attachment 374961 [details]
testcase

See testcase, which hangs in current trunk build, it doesn't hang in Firefox 3.

The crash log, I get from my Mac debug build after it crashes because of too long hanging:
Thread 0 Crashed:
0   libSystem.B.dylib             	0x90fd8e42 __kill + 10
1   libSystem.B.dylib             	0x9104b23a raise + 26
2   libSystem.B.dylib             	0x91057679 abort + 73
3   libnspr4.dylib                	0x001497ef PR_Assert + 0 (prlog.c:547)
4   libxpcom_core.dylib           	0x0055ba9d Abort(char const*) + 21
5   libxpcom_core.dylib           	0x0055bd71 NS_DebugBreak_P + 657 (nsDebugImpl.cpp:322)
6   libgklayout.dylib             	0x12ec7c92 nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, int*) + 616 (nsBlockFrame.cpp:3293)
7   libgklayout.dylib             	0x12ec8108 nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*) + 1012 (nsBlockFrame.cpp:2317)
8   libgklayout.dylib             	0x12ec895b nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) + 1985 (nsBlockFrame.cpp:1897)
9   libgklayout.dylib             	0x12ecbc15 nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) + 795 (nsBlockFrame.cpp:944)
10  libgklayout.dylib             	0x12ecf887 nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, int, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) + 477 (nsBlockReflowContext.cpp:310)
11  libgklayout.dylib             	0x12ec5b0e nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, int*) + 2076 (nsBlockFrame.cpp:2990)
12  libgklayout.dylib             	0x12ec7e38 nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*) + 292 (nsBlockFrame.cpp:2262)
13  libgklayout.dylib             	0x12ec895b nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) + 1985 (nsBlockFrame.cpp:1897)
14  libgklayout.dylib             	0x12ecbc15 nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) + 795 (nsBlockFrame.cpp:944)
15  libgklayout.dylib             	0x12ecf887 nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, int, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) + 477 (nsBlockReflowContext.cpp:310)
etc...
(Reporter)

Comment 1

8 years ago
It wasn't hanging in a 2009-02-14 trunk build, so a fairly recent regression.
(Reporter)

Comment 2

8 years ago
This seems to have regressed between 2009-04-18 and 2009-04-20:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2009-04-18+04%3A00%3A00&enddate=2009-04-20+06%3A00%3A00
Flags: blocking1.9.2?
I get a cycle of assertions during the loop:

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /home/dbaron/builds/mozilla-central/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: Text run does not map enough text for our reflow: 'gfxSkipCharsIterator(iter).ConvertOriginalToSkipped(offset + length) <= mTextRun->GetLength()', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsTextFrameThebes.cpp, line 6153
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /home/dbaron/builds/mozilla-central/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: unconstrained height on totally empty line: 'NS_UNCONSTRAINEDSIZE != aFloatAvailableSpace.mRect.height', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsBlockFrame.cpp, line 3660
###!!! ASSERTION: redo line on totally empty line with non-empty band...: 'aFloatAvailableSpace.mHasFloats', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsBlockFrame.cpp, line 3665



I verified by local backout that this was caused by
http://hg.mozilla.org/mozilla-central/rev/f9627950be8f
(I backed out some of the things on top of it first; not sure if I needed to, though)
Blocks: 332655
Flags: blocking1.9.2? → blocking1.9.2+
Priority: -- → P2
is this OS X only? with current 3.5.3 the testcase hangs for me on Windows, while using current trunk it does not hang, nor with current 1.9.2.
I see this on Mac.
Assignee: nobody → smontagu
(Assignee)

Comment 6

8 years ago
Created attachment 405136 [details] [diff] [review]
Patch
Attachment #405136 - Flags: superreview?(roc)
Attachment #405136 - Flags: review?(roc)
Attachment #405136 - Flags: superreview?(roc)
Attachment #405136 - Flags: superreview+
Attachment #405136 - Flags: review?(roc)
Attachment #405136 - Flags: review+
Whiteboard: [needs landing]
(Assignee)

Comment 7

8 years ago
http://hg.mozilla.org/mozilla-central/rev/fa7cae321eff
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
(Assignee)

Updated

8 years ago
Whiteboard: [needs landing]
(Assignee)

Comment 8

8 years ago
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fffed35054b5
status1.9.2: --- → beta1-fixed
(Assignee)

Comment 9

8 years ago
Comment on attachment 405136 [details] [diff] [review]
Patch

Requesting approval1.9.1 after trunk baking time, since this fixes a regression from bug 332655
Attachment #405136 - Flags: approval1.9.1.5?
(Assignee)

Updated

8 years ago
Blocks: 508334
Comment on attachment 405136 [details] [diff] [review]
Patch

Approved for 1.9.1.5, a=dveditz
Attachment #405136 - Flags: approval1.9.1.5? → approval1.9.1.5+
(Assignee)

Comment 11

8 years ago
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/07ff9d432dac
status1.9.1: --- → .5-fixed
Verified for 1.9.1.6 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.6pre) Gecko/20091119 Shiretoko/3.5.6pre using testcase. Saw crash with testcase in 1.9.1.5.

Verified for 1.9.2 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2b4pre) Gecko/20091123 Namoroka/3.6b4pre.
Keywords: verified1.9.1, verified1.9.2
You need to log in before you can comment on or make changes to this bug.