550306 - Too-much-recursion crash with <xul:listbox>, negative margin

Status: RESOLVED INCOMPLETE

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

The repeating part of the stack:

169 PresShell::FlushPendingNotifications(mozFlushType) + 706 (nsPresShell.cpp:4800)
170 PresShell::HandlePostedReflowCallbacks(int) + 250 (nsPresShell.cpp:4692)
171 PresShell::DidDoReflow(int) + 40 (nsPresShell.cpp:7215)
172 PresShell::ProcessReflowCommands(int) + 419 (nsPresShell.cpp:7479)
173 PresShell::FlushPendingNotifications(mozFlushType) + 706 (nsPresShell.cpp:4800)

Comment 1

[Boris Zbarsky [:bzbarsky]]

So what makes listboxes set up a post-reflow callback?

Comment 2

[[e-mail]]

Well, it seems to work like this: During reflow, when a row is discovered to be taller than any row seen so far, all the rows are resized to the same size, and the listbox's minheight is also increased if its height was based on the number of rows. A reflow callback is then posted to update the layout. Note that resizing the rows will change the first visible item (e.g. if item 12 was the first visible, and the row height increased from 20 to 24, then item 10 will now appear to be the first visible), so the callback posts another callback to change the scroll position so that the originally first visible row is correct.

Comment 3

[[e-mail]]

I wonder whether a zero row height could be the problem.

Comment 4

[Jesse Ruderman]

Due to the combination of this bug with bug 507876, I can't look for other too-much-recursion crashes while fuzzing.

Comment 5

[Jesse Ruderman]

Bug 575446 shows a similar too-much-recursion pattern with xul trees.

Comment 6

[Jesse Ruderman]

Attachment: testcase 2

Comment 7

[Jesse Ruderman]

This makes fuzzing difficult.

Comment 8

[Benjamin Smedberg]

*This* bug about XUL is not a blocker because it can't be touched by content. Jesse will file a different bug about filter:, and that will probably be a blocker.

Comment 9

[Jesse Ruderman]

After re-reading comment 2, I'm moving "testcase 2" along with "this makes fuzzing difficult" to bug 601999.

Comment 10

[Andrei Purice]

Hey Jesse,
Can you still reproduce this issue or can it be closed?

Comment 11

[Andrei Purice]

Marking this as Resolved > Incomplete due to the lack of info.
If anyone is able to reproduce this issue re-open it or file a new bug.