691824 - Hang using latest nightly

Status: VERIFIED FIXED

(Core :: Layout: Positioned, defect)

Description

[Bram Speeckaert]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111004 Firefox/10.0a1
Build ID: 20111004030858

Steps to reproduce:

1) Open http://forum.shrimprefuge.be/showpost.php?p=833327&postcount=1342 in a tab.
2) Click 'Toon' button.
3) Click 'Verklein' button, close the tab or close Firefox.


Actual results:

Firefox will hang and soak up a CPU core completely every single time.


Expected results:

The page should return to the state it was in before clicking the 'Toon' button.

The hang occurs with the latest nightly, but not with the latest Aurora build. Managed to trigger the hang consistently on:
-Windows 7 64bit using both 32 and 64bit nightlies
-Windows XP
-Ubuntu 10.10 32bit running in VirtualBox

Comment 1

[Matthias Versen [:Matti]]

confirming with Mozilla/5.0 (Windows NT 6.1; rv:10.0a1) Gecko/20111003 Firefox/10.0a1 SeaMonkey/2.7a1

This works with FF7.0.1
Will try to find a regression range and or stack trace later

Comment 2

[Alice0775 White]

Confirmed

Regression window(m-c hourly)
Works:
http://hg.mozilla.org/mozilla-central/rev/60e86b847759
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20110929 Firefox/10.0a1 ID:20110929122038
Fails:
http://hg.mozilla.org/mozilla-central/rev/af3668a89015
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20110929 Firefox/10.0a1 ID:20110929141938
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=60e86b847759&tochange=af3668a89015

Comment 3

[Boris Zbarsky [:bzbarsky]]

My money is on Ehsan here....

Comment 4

[Alice0775 White]

Attachment: WinDbg log

Comment 5

[Boris Zbarsky [:bzbarsky]]

Looks like a RecreateFramesForContent leading to lots of CaptureFrameState.....  Are we just recreating over and over or something else?

Comment 6

[Alice0775 White]

Attachment: reduced html

Comment 7

[(no longer active)]

Attachment: Patch (v1)

This was a stupid mistake that I made.  nsTableOuterFrame::GetChildLists was returning the principal child list twice.

Comment 8

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0900c7080d8c

Comment 9

[(no longer active)]

This patch https://hg.mozilla.org/mozilla-central/rev/306153bf7a41 was effectively wallpapering over this bug... :-)

So I backed it out now that this is fixed for real:

https://hg.mozilla.org/integration/mozilla-inbound/rev/a9c247a14c62

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0900c7080d8c
https://hg.mozilla.org/mozilla-central/rev/a9c247a14c62

Comment 11

[Mozilla RelEng Bot]

Try run for 2b3b601727a6 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=2b3b601727a6
Results (out of 193 total builds):
    exception: 2
    success: 154
    warnings: 15
    failure: 22
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-2b3b601727a6

Comment 12

[Alex Keybl [:akeybl]]

Now that we have a better understanding of this bug, is it of enough concern (and the patch low enough risk) to consider for Beta 10?

Comment 13

[Alex Keybl [:akeybl]]

Sorry, missed that this was fixed on 10 already. Disregard the above.