62049 - toggling display block/none on tables causes browser to freeze

Status: VERIFIED DUPLICATE of bug 70648

(Core :: Layout, defect, P3)

Description

[Jacob Kjome]

Testing with MTrunk build 2000120504

Attaching test case shortly.

The testcase contains a table in which one of the two rows is toggled display: 
none and display: block.  Initially is is displayed.  The first click toggles 
it to display: none.  The second click toggles to display:block, however, row 
of the table that was toggled display: none before doesn't come back.  Then, if 
you try to toggle it again, the browser freezes and has to be brought down by 
killing the process.

In addition, I have the same setup just below the table in DIV tags rather than 
a table.  It works fine with all of the above.  I put it there for comparison.

Jake

Comment 1

[Jacob Kjome]

Attachment: Testcase showing browser freeze when toggle of display none/block on table row

Comment 2

[Boris Zbarsky [:bzbarsky]]

I see this with linux build 2000-12-05-08 and a CVS build from the same day.

You should be using display:table-row, not display:block for a table row.  But
Moz should still not hang here....

Output from CVS build:

frame: TableCell(td)(1) (0x8716bc8) style: 0x88f9088 {
  http://www.w3.org/1999/xhtml|td weight: 1 { vertical-align: inherit
text-align: inherit display: 16[0x10]enum }
  valign = 13[0xd]enum
  *|* weight: 0 { width: 215px }
}
Wrong parent style context:  style: 0x88f8988 {
  http://www.w3.org/1999/xhtml|tr weight: 1 { vertical-align: inherit display:
15[0xf]enum }
  *|*.show weight: 256 { display: 1[0x1]enum }
}
should be using:  style: 0x8590620 :table-row {
  *|:table-row weight: 0 { display: 15[0xf]enum }
}

frame: TableCell(td)(1) (0x89359f4) style: 0x85ad8b0 {
  http://www.w3.org/1999/xhtml|td weight: 1 { vertical-align: inherit
text-align: inherit display: 16[0x10]enum }
  valign = 13[0xd]enum
  *|* weight: 0 { width: 215px }
}
Wrong parent style context:  style: 0x892b148 {
  http://www.w3.org/1999/xhtml|tr weight: 1 { vertical-align: inherit display:
15[0xf]enum }
  *|*.show weight: 256 { display: 1[0x1]enum }
}
should be using:  style: 0x899b3d8 :table-row {
  *|:table-row weight: 0 { display: 15[0xf]enum }
}
###!!! ASSERTION: can't find deleted frame in lines: 'nsnull != line', file
nsBlockFrame.cpp, line 5463
###!!! Break: at file nsBlockFrame.cpp, line 5463
###!!! ASSERTION: whoops, continuation without a parent: 'nsnull != flow', file
nsBlockFrame.cpp, line 5581
###!!! Break: at file nsBlockFrame.cpp, line 5581

Reassigning to layout based on the following stack trace from right after the hang:

#0  0x4112f470 in nsBlockFrame::DoRemoveFrame (this=0x85f9e90,
aPresContext=0x86af3d0,
    aDeletedFrame=0x85fa190) at nsBlockFrame.cpp:5587
        presShell = {mRawPtr = 0x4240d028}
        flow = (nsBlockFrame *) 0x0
        linep = (nsLineBox **) 0x85f9ecc
        line = (nsLineBox *) 0x0
        prevLine = (nsLineBox *) 0x0
        prevSibling = (nsIFrame *) 0x0
#1  0x4112ef7e in nsBlockFrame::RemoveFrame (this=0x85f9e90,
aPresContext=0x86af3d0,
    aPresShell=@0x4240d028, aListName=0x0, aOldFrame=0x85fa190) at
nsBlockFrame.cpp:5423
        aListName = (nsIAtom *) 0xbfffd890
        aOldFrame = (nsIFrame *) 0x85fa190
        rv = 0
#2  0x4114aadd in FrameManager::RemoveFrame (this=0x41d344d0,
aPresContext=0x86af3d0,
    aPresShell=@0x4240d028, aParentFrame=0x85f9e90, aListName=0x0,
aOldFrame=0x85fa190)
    at nsFrameManager.cpp:771
        this = (FrameManager *) 0x402c8001
        aParentFrame = (nsIFrame *) 0x85f9e90
        aOldFrame = (nsIFrame *) 0x85fa190
        insertionPoint = (nsIFrame *) 0x0
#3  0x41319f14 in nsCSSFrameConstructor::ContentRemoved (this=0x41d01ee8,
    aPresContext=0x86af3d0, aContainer=0x8233908, aChild=0x8234510,
aIndexInContainer=3)
    at nsCSSFrameConstructor.cpp:9508
        outerTableFrame = (class nsIFrame *) 0x85f9e90
        position = (nsStylePosition *) 0x8233454
        parentFrame = (nsIFrame *) 0x85f9e90
        containingBlock = (nsIFrame *) 0x85f9e90
        blockSC = {mRawPtr = 0x861a518}
        blockContent = {mRawPtr = 0x8233908}
        haveFLS = 0
        display = (nsStyleDisplay *) 0x82334d8
        shell = {mRawPtr = 0x4240d028}
        frameManager = {mRawPtr = 0x41d344d0}
        rv = 0
        childFrame = (nsIFrame *) 0x85fa190
        result = 2147500034
#4  0x4132079f in nsCSSFrameConstructor::RecreateFramesForContent (this=0x41d01ee8,
    aPresContext=0x86af3d0, aContent=0x8234510) at nsCSSFrameConstructor.cpp:11252
        indexInContainer = 3
        this = (nsCSSFrameConstructor *) 0x41d01ee8
        rv = 0
        container = (nsIContent *) 0x8233908
#5  0x4131c3d1 in nsCSSFrameConstructor::AttributeChanged (this=0x41d01ee8,
    aPresContext=0x86af3d0, aContent=0x8234510, aNameSpaceID=0,
aAttribute=0x80cfa08,
    aHint=2) at nsCSSFrameConstructor.cpp:10157
        maxHint = 5
        changeList = {mArray = 0xbfffe088, mArraySize = 10, mCount = 1, mBuffer = {{
      mFrame = 0x85fa190, mContent = 0x8234510, mHint = 5}, {mFrame = 0x4168bfc4,
      mContent = 0x85e8b60, mHint = -1073749596}, {mFrame = 0x40161b18,
      mContent = 0xbfffe0c8, mHint = 1095057654}, {mFrame = 0x85e8b60, mContent
= 0x8,
      mHint = 1096837989}, {mFrame = 0x80647c8, mContent = 0x41606b4a,
      mHint = 1097383876}, {mFrame = 0xbfffe190, mContent = 0xbfffe0d8,
      mHint = 1093120252}, {mFrame = 0x85e8b60, mContent = 0x4168bfc4,
      mHint = -1073749580}, {mFrame = 0x411acf5f, mContent = 0x85e8b60,
      mHint = 1097383876}, {mFrame = 0xbfffe338, mContent = 0xbfffe334, mHint =
4}, {
      mFrame = 0xbfffe10c, mContent = 0xbfffe110, mHint = 140490560}}}
        frameManager = {mRawPtr = 0x41d344d0}
        affects = 1
        result = 0
        shell = {mRawPtr = 0x4240d028}
        primaryFrame = (nsIFrame *) 0x85fa190
        reconstruct = 0
        restyle = 1
        reframe = 0
#6  0x414e2dc5 in StyleSetImpl::AttributeChanged (this=0x41d01e78,
    aPresContext=0x86af3d0, aContent=0x8234510, aNameSpaceID=0,
aAttribute=0x80cfa08,
    aHint=-1) at nsStyleSet.cpp:1211
        this = (StyleSetImpl *) 0x0
#7  0x4118565d in PresShell::AttributeChanged (this=0x4240d028,
aDocument=0x85e8b60,
    aContent=0x8234510, aNameSpaceID=0, aAttribute=0x80cfa08, aHint=-1)
    at nsPresShell.cpp:4255
        this = (PresShell *) 0x4240d028
        rv = 1111543900
#8  0x414578c1 in nsDocument::AttributeChanged (this=0x85e8b60, aChild=0x8234510,
    aNameSpaceID=0, aAttribute=0x80cfa08, aHint=-1) at nsDocument.cpp:1952
        observer = (nsIDocumentObserver *) 0x4240d030
        rv = 0
        i = 0
        result = 0
#9  0x411ae1f6 in nsGenericHTMLElement::SetAttribute (this=0x823451c,
aNameSpaceID=0,
    aAttribute=0x80cfa08, aValue=@0xbfffe440, aNotify=1) at
nsGenericHTMLElement.cpp:1479
        bindingManager = {mRawPtr = 0x42453da0}
        binding = {mRawPtr = 0x0}
        result = 0
        val = {mUnit = eHTMLUnit_Null, mValue = {mInt = 0, mFloat = 0, mString =
0x0,
    mISupports = 0x0, mColor = 0}}
        htmlContent = (nsIHTMLContent *) 0x0
        strValue = {<nsString> = {<basic_nsAWritableString<short unsigned int>>
= {<basic_nsAReadableString<short unsigned int>> =
{<nsPrivateSharableString<short unsigned int>> = {
          _vptr. = 0x4015a500 <nsAutoString virtual table>}, <No data fields>},
<No data fields>}, <nsStr> = {mLength = 4, mCapacity = 63, mCharSize = eTwoByte,
mOwnsBuffer = 0, {
        mStr = 0xbfffe354 "s", mUStr = 0xbfffe354}}, <No data fields>},
  mBuffer =
"s\000h\000o\000w\000\000\000ÿÿ|ãÿ¿\224ãÿ¿¨ãÿ¿¼ãÿ¿¼ãÿ¿\020\205\"\b\004\000\000\000\000\000\000\000`Ä¡A\004\000\000\000\000\000\000\000\004\000\000\000\004\000\000\000Xäÿ¿`äÿ¿\000\000\000\000`äÿ¿@äÿ¿\230\227ßA \227ßA\000\000\000\000 \227ßAðãÿ¿\230\227ßA \227ßA\000\000\000\000 \227ßAðãÿ¿üãÿ¿"}
        modification = 1
#10 0x411a87bb in nsGenericHTMLElement::SetClassName (this=0x823451c,
    aClassName=@0xbfffe440) at nsGenericHTMLElement.cpp:578
No locals.
#11 0x4125399f in nsHTMLTableRowElement::SetClassName (this=0x8234508,
aClassName=@0xbfffe440) at nsHTMLTableRowElement.cpp:152
No locals.

Comment 3

[Boris Zbarsky [:bzbarsky]]

OS -> All. Severity -> critical. Sorry for the extra spam....

Comment 4

[Jacob Kjome]

Boris, I changed the display to table-row instead of block (on a local copy of 
the testcase) and I get the same freeze.  Looks like this has more to do with 
setting display to none then re-displaying the content when that content is in 
a table regardless of display values used.  As you can see from the testcase, 
it works fine for DIV tags.

Jake

Comment 5

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Please triage.

Comment 6

[harishd]

Triaging Clayton's bug list:

Reassinging bug to karnaze and ccing buster.

Comment 7

[Bernd]

it cycles in the while loop at
http://lxr.mozilla.org/seamonkey/source/layout/html/base/src/nsBlockFrame.cpp#5472

with

aDeletedDFrame != nsnull
line = nsnull
flow = nsnull

Comment 8

[karnaze (gone)]

moving to mozilla0.9.1

Comment 9

[Marc Attinasi]

Fixing the code in the BlockFrame so it cannot recurse infinitely is easy, but
the problem as far as I can see is really due to the BlockFrame for a
nsHTMLTableSectionElement, which does not have any lines at all.


may be related to bug 70648

Comment 10

[Marc Attinasi]

Dup of bug 70648 (which, though later, is more general than this table-specific
report - that is why I am duping to a leter bug).

*** This bug has been marked as a duplicate of 70648 ***

Comment 11

[Fabian Guisset]

VERIFIED dup