Last Comment Bug 490559 - Hang [@ nsBlockFrame::ReflowInlineFrames] with removing 𐶅 and small width
: Hang [@ nsBlockFrame::ReflowInlineFrames] with removing 𐶅 and small width
Status: RESOLVED FIXED
: hang, regression, verified1.9.1, verified1.9.2
Product: Core
Classification: Components
Component: Layout (show other bugs)
: unspecified
: x86 Mac OS X
: P2 critical (vote)
: ---
Assigned To: Simon Montagu :smontagu
:
Mentors:
Depends on:
Blocks: 332655 508334
  Show dependency treegraph
 
Reported: 2009-04-28 16:35 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2009-11-23 17:01 PST (History)
6 users (show)
roc: blocking1.9.2+
smontagu: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
beta1-fixed
.6-fixed


Attachments
testcase (254 bytes, text/html)
2009-04-28 16:35 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
Patch (2.43 KB, patch)
2009-10-07 14:16 PDT, Simon Montagu :smontagu
roc: review+
roc: superreview+
dveditz: approval1.9.1.6+
Details | Diff | Splinter Review

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2009-04-28 16:35:11 PDT
Created attachment 374961 [details]
testcase

See testcase, which hangs in current trunk build, it doesn't hang in Firefox 3.

The crash log, I get from my Mac debug build after it crashes because of too long hanging:
Thread 0 Crashed:
0   libSystem.B.dylib             	0x90fd8e42 __kill + 10
1   libSystem.B.dylib             	0x9104b23a raise + 26
2   libSystem.B.dylib             	0x91057679 abort + 73
3   libnspr4.dylib                	0x001497ef PR_Assert + 0 (prlog.c:547)
4   libxpcom_core.dylib           	0x0055ba9d Abort(char const*) + 21
5   libxpcom_core.dylib           	0x0055bd71 NS_DebugBreak_P + 657 (nsDebugImpl.cpp:322)
6   libgklayout.dylib             	0x12ec7c92 nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, int*) + 616 (nsBlockFrame.cpp:3293)
7   libgklayout.dylib             	0x12ec8108 nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*) + 1012 (nsBlockFrame.cpp:2317)
8   libgklayout.dylib             	0x12ec895b nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) + 1985 (nsBlockFrame.cpp:1897)
9   libgklayout.dylib             	0x12ecbc15 nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) + 795 (nsBlockFrame.cpp:944)
10  libgklayout.dylib             	0x12ecf887 nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, int, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) + 477 (nsBlockReflowContext.cpp:310)
11  libgklayout.dylib             	0x12ec5b0e nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, int*) + 2076 (nsBlockFrame.cpp:2990)
12  libgklayout.dylib             	0x12ec7e38 nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*) + 292 (nsBlockFrame.cpp:2262)
13  libgklayout.dylib             	0x12ec895b nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) + 1985 (nsBlockFrame.cpp:1897)
14  libgklayout.dylib             	0x12ecbc15 nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) + 795 (nsBlockFrame.cpp:944)
15  libgklayout.dylib             	0x12ecf887 nsBlockReflowContext::ReflowBlock(nsRect const&, int, nsCollapsingMargin&, int, int, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) + 477 (nsBlockReflowContext.cpp:310)
etc...
Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2009-04-28 16:41:57 PDT
It wasn't hanging in a 2009-02-14 trunk build, so a fairly recent regression.
Comment 2 Martijn Wargers [:mwargers] (not working for Mozilla) 2009-05-06 15:00:14 PDT
This seems to have regressed between 2009-04-18 and 2009-04-20:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2009-04-18+04%3A00%3A00&enddate=2009-04-20+06%3A00%3A00
Comment 3 David Baron :dbaron: ⌚️UTC+2 (mostly busy through August 4; review requests must explain patch) 2009-07-22 07:58:03 PDT
I get a cycle of assertions during the loop:

###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /home/dbaron/builds/mozilla-central/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: Text run does not map enough text for our reflow: 'gfxSkipCharsIterator(iter).ConvertOriginalToSkipped(offset + length) <= mTextRun->GetLength()', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsTextFrameThebes.cpp, line 6153
###!!! ASSERTION: Invalid offset: 'aOffset <= mSkipChars->mCharCount', file /home/dbaron/builds/mozilla-central/mozilla/gfx/thebes/src/gfxSkipChars.cpp, line 92
###!!! ASSERTION: unconstrained height on totally empty line: 'NS_UNCONSTRAINEDSIZE != aFloatAvailableSpace.mRect.height', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsBlockFrame.cpp, line 3660
###!!! ASSERTION: redo line on totally empty line with non-empty band...: 'aFloatAvailableSpace.mHasFloats', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsBlockFrame.cpp, line 3665



I verified by local backout that this was caused by
http://hg.mozilla.org/mozilla-central/rev/f9627950be8f
(I backed out some of the things on top of it first; not sure if I needed to, though)
Comment 4 Marco Bonardo [::mak] (Away 6-20 Aug) 2009-10-06 05:28:58 PDT
is this OS X only? with current 3.5.3 the testcase hangs for me on Windows, while using current trunk it does not hang, nor with current 1.9.2.
Comment 5 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2009-10-07 03:50:27 PDT
I see this on Mac.
Comment 6 Simon Montagu :smontagu 2009-10-07 14:16:43 PDT
Created attachment 405136 [details] [diff] [review]
Patch
Comment 7 Simon Montagu :smontagu 2009-10-07 22:02:02 PDT
http://hg.mozilla.org/mozilla-central/rev/fa7cae321eff
Comment 8 Simon Montagu :smontagu 2009-10-13 00:04:08 PDT
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fffed35054b5
Comment 9 Simon Montagu :smontagu 2009-10-18 02:27:33 PDT
Comment on attachment 405136 [details] [diff] [review]
Patch

Requesting approval1.9.1 after trunk baking time, since this fixes a regression from bug 332655
Comment 10 Daniel Veditz [:dveditz] 2009-10-23 11:38:44 PDT
Comment on attachment 405136 [details] [diff] [review]
Patch

Approved for 1.9.1.5, a=dveditz
Comment 11 Simon Montagu :smontagu 2009-10-25 00:54:04 PDT
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/07ff9d432dac
Comment 12 Al Billings [:abillings] 2009-11-23 17:01:55 PST
Verified for 1.9.1.6 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.6pre) Gecko/20091119 Shiretoko/3.5.6pre using testcase. Saw crash with testcase in 1.9.1.5.

Verified for 1.9.2 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2b4pre) Gecko/20091123 Namoroka/3.6b4pre.

Note You need to log in before you can comment on or make changes to this bug.