531603 - Crash [@ nsHTMLReflowState::GetHypotheticalBoxContainer]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P2)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build after 200ms.
It doesn't crash in Firefox3.5.

http://crash-stats.mozilla.com/report/index/b7ad0756-07c1-408b-a6c4-b72c42091129
0	xul.dll	nsHTMLReflowState::GetHypotheticalBoxContainer
1	xul.dll	nsHTMLReflowState::InitAbsoluteConstraints
2	xul.dll	nsHTMLReflowState::InitConstraints
3	xul.dll	nsHTMLReflowState::Init
4	xul.dll	nsAbsoluteContainingBlock::ReflowAbsoluteFrame
5	xul.dll	nsAbsoluteContainingBlock::Reflow
6	xul.dll	ViewportFrame::Reflow
7	xul.dll	PresShell::DoReflow
8	xul.dll	PresShell::ProcessReflowCommands
9	xul.dll	PresShell::FlushPendingNotifications
10	nspr4.dll	PR_Lock
11	xul.dll	nsThread::ProcessNextEvent
12	xul.dll	nsBaseAppShell::Run
13	nspr4.dll	PR_GetEnv
14	firefox.exe	wmain
15	firefox.exe	__tmainCRTStartup
16	kernel32.dll	BaseProcessStart

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h.  Unregistering ourselves, but this might cause our out-of-flow to be unable to destroy itself properly.  Not that it could anyway, with us dead.: 'Error', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 137
###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file /home/dbaron/builds/mozilla-central/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1165

Comment 2

[Mats Palmgren (inactive)]

Regression range:  2009-10-18-03 -- 2009-10-19-03
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a176eb500f88&tochange=d3298de30066
Backing out bug 504524 (changeset d3298de30066) locally fixes it.

Comment 3

[Mats Palmgren (inactive)]

Attachment: dirty lines

More specifically, adding back this block fixes the crash, fwiw.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

We really don't want to add back those lines :-).

I assume this is not a problem on 1.9.2 since 504524 hasn't landed there.

Comment 5

[(mostly gone) XtC4UaLL [:xtc4uall]]

this is WFM/not crashing anymore using Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.3a6pre) Gecko/20100618 Minefield/3.7a6pre (http://hg.mozilla.org/mozilla-central/rev/979b65e6b73e). seems to have been fixed/mitigated.

Comment 6

[Damon Sicore (:damons)]

Bumping this to beta2 per beta re-triage with dbaron.  If this should indeed block beta1, please re-nom.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Moving to betaN - requires beta coverage, no specific beta milestone targetted at this time.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Does not crash for me. No assertions either. Can anyone reproduce this? Martijn?