755570 - Crash [@ nsHTMLReflowState::ComputeContainingBlockRectangle]

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Christian Holler (:decoder)]

This bug was filed from the Socorro interface and is 
report bp-8278fd88-3ab3-41da-9c40-c56b42120515 .
============================================================= 


The following test asserts/crashes on Fennec native (tested on Aurora build as in crash report and mozilla-central debug build rev 448f554f6acb):


<script>
try {  allNodes = [];  } catch(exc) {}
try {  allNodes[5] = document.createElementNS("http://www.w3.org/1999/xhtml", "body");  } catch(exc) {}
try {  allNodes[44] = document.createElementNS("http://www.w3.org/1999/xhtml", "table");  } catch(exc) {}
try {  allNodes[56] = document.createElementNS("http://www.w3.org/1999/xhtml", "td");  } catch(exc) {}
try {  allNodes[57] = document.createElementNS("http://www.w3.org/1999/xhtml", "form");  } catch(exc) {}
try {  allNodes[58] = document.createElementNS("http://www.w3.org/1999/xhtml", "input");  } catch(exc) {}
try {  (allNodes[57] || allNodes[56] || allNodes[46] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[58]);  } catch(exc) {}
try {  (allNodes[56] || allNodes[46] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[57]);  } catch(exc) {}
try {  (allNodes[46] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[56]);  } catch(exc) {}
try {  (allNodes[5] || document.documentElement).appendChild(allNodes[44]);  } catch(exc) {}
try {  (document.documentElement).appendChild(allNodes[5]);  } catch(exc) {}
try {  allNodes[44].style.cssFloat = "left";  } catch(exc) {}
try {  allNodes[5].style.display = "-moz-deck";  } catch(exc) {}
try {  allNodes[56].style.display = "-moz-initial";  } catch(exc) {}
</script>


The test also triggered this assertion:

###!!! ASSERTION: no containing block: 'nsnull != cbrs', file layout/generic/nsHTMLReflowState.cpp, line 1730

Comment 1

[Mats Palmgren (inactive)]

Attachment: crash stack, Linux64 Firefox debug trunk build

Comment 2

[Mats Palmgren (inactive)]

Related to font-inflation?

Comment 3

[Scott Johnson (:jwir3)]

(In reply to Mats Palmgren [:mats] from comment #2)
> Related to font-inflation?

Yeah, this definitely looks like a FI issue. I'll take a look at it and see if I can come up with what's happening.

Comment 4

[Mats Palmgren (inactive)]

BTW, why is a desktop build with a default profile doing font-inflation work?

Comment 5

[Scott Johnson (:jwir3)]

(In reply to Mats Palmgren [:mats] from comment #4)
> BTW, why is a desktop build with a default profile doing font-inflation work?

Well, that's interesting. I didn't realize you had a default profile. I'm not sure, but it's probably something we shouldn't be doing...

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 8

[Andrei Purice]

Closing this issue as Resolved > Worksforme since no crashes with this Signature were reported in the last 6 months.