Closed Bug 591304 Opened 14 years ago Closed 10 years ago

Hang/crash [@ gfxFont::Measure][@ nsRegion::Or] with filter, position:fixed and float

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
blocking2.0 --- -

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

testcase
316 bytes, text/html
Details
Attached file testcase —
See testcase, which crashes current trunk build after 200ms, after hanging for a while. This seems to have regressed between 2010-08-13 and 2010-08-14: http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2010-08-13+04%3A00%3A00&enddate=2010-08-14+06%3A00%3A00 http://crash-stats.mozilla.com/report/index/41309ac7-0b76-4979-a8ed-8df702100827 0 xul.dll gfxFont::Measure gfx/thebes/gfxFont.cpp:1220 1 xul.dll gfxTextRun::MeasureText gfx/thebes/gfxFont.cpp:3406 2 xul.dll gfxTextRun::BreakAndMeasureText gfx/thebes/gfxFont.cpp:3564 3 xul.dll nsTextFrame::Reflow layout/generic/nsTextFrameThebes.cpp:6434 4 xul.dll nsLineLayout::ReflowFrame layout/generic/nsLineLayout.cpp:835 5 xul.dll nsBlockFrame::ReflowInlineFrame layout/generic/nsBlockFrame.cpp:3750 6 xul.dll nsBlockFrame::DoReflowInlineFrames layout/generic/nsBlockFrame.cpp:3546 7 xul.dll nsBlockFrame::ReflowInlineFrames layout/generic/nsBlockFrame.cpp:3405 8 xul.dll nsBlockFrame::ReflowLine layout/generic/nsBlockFrame.cpp:2493 9 xul.dll nsBlockFrame::ReflowDirtyLines layout/generic/nsBlockFrame.cpp:1931 10 xul.dll nsBlockFrame::Reflow layout/generic/nsBlockFrame.cpp:1021 11 xul.dll nsContainerFrame::ReflowChild layout/generic/nsContainerFrame.cpp:738 12 xul.dll nsColumnSetFrame::ReflowChildren layout/generic/nsColumnSetFrame.cpp:670 13 xul.dll nsColumnSetFrame::Reflow layout/generic/nsColumnSetFrame.cpp:1032 14 xul.dll nsAbsoluteContainingBlock::ReflowAbsoluteFrame layout/generic/nsAbsoluteContainingBlock.cpp:450 15 xul.dll nsAbsoluteContainingBlock::Reflow layout/generic/nsAbsoluteContainingBlock.cpp:160 16 xul.dll ViewportFrame::Reflow layout/generic/nsViewportFrame.cpp:329 17 xul.dll PresShell::DoReflow layout/base/nsPresShell.cpp:7546 18 xul.dll PresShell::ProcessReflowCommands layout/base/nsPresShell.cpp:7681 19 xul.dll PresShell::FlushPendingNotifications layout/base/nsPresShell.cpp:4812 etc...
Looks like an infinite recursion with this basic unit: PresShell::ProcessReflowCommands layout/base/nsPresShell.cpp:7693 PresShell::FlushPendingNotifications layout/base/nsPresShell.cpp:4812 PresShell::HandlePostedReflowCallbacks layout/base/nsPresShell.cpp:4679 PresShell::DidDoReflow layout/base/nsPresShell.cpp:7423 PresShell::ProcessReflowCommands layout/base/nsPresShell.cpp:7693 ccing the people with patches in the range that are most likely to be relevant. I'd be curious to find out what reflow callback this is. Scrollframe?
blocking2.0: --- → ?
Crash Signature: [@ gfxFont::Measure]
It's now crashing swiftly on trunk and with a different stack: https://crash-stats.mozilla.com/report/index/409c5423-51cd-4af2-80e4-28d092110907 0 xul.dll nsRegion::Or gfx/src/nsRegion.cpp:782 1 xul.dll nsRegion::Or gfx/src/nsRegion.cpp:798 2 xul.dll nsViewManager::UpdateWidgetArea view/src/nsViewManager.cpp:515 3 xul.dll nsIFrame::InvalidateInternal layout/generic/nsFrame.cpp:4348 4 xul.dll nsIFrame::InvalidateInternal layout/generic/nsFrame.cpp:4348 5 xul.dll nsIFrame::InvalidateInternal layout/generic/nsFrame.cpp:4348 6 xul.dll nsIFrame::InvalidateInternal layout/generic/nsFrame.cpp:4348 7 xul.dll nsIFrame::InvalidateInternal layout/generic/nsFrame.cpp:4348
Crash Signature: [@ gfxFont::Measure] → [@ gfxFont::Measure][@ nsRegion::Or]
Summary: Hang/crash [@ gfxFont::Measure] with filter, position:fixed and float → Hang/crash [@ gfxFont::Measure][@ nsRegion::Or] with filter, position:fixed and float
Still crashing, bug 618421 (top crash) is perhaps related?
I can still reproduce this with the testcase, but I don't get the crashreporter.
Crash Signature: [@ gfxFont::Measure][@ nsRegion::Or] → [@ gfxFont::Measure] [@ nsRegion::Or] [@ nsRegion::Or(nsRegion const&, nsRegion const&) ]
Regression window: Not crash: http://hg.mozilla.org/mozilla-central/rev/69e2e34ccddc Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b4pre) Gecko/20100813 Minefield/4.0b4pre ID:20100813065209 Crash: http://hg.mozilla.org/mozilla-central/rev/9fd11a17eb1a Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b4pre) Gecko/20100813 Minefield/4.0b4pre ID:20100813072506 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=69e2e34ccddc&tochange=9fd11a17eb1a
Last Good :8b129680a3bb First Bad :4a50f3c34d5a
Blocks: 506826
This is worksforme in current trunk build.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: