Closed
Bug 757413
Opened 14 years ago
Closed 10 years ago
Crash [@ mozilla::layout::FrameChildListIterator::FrameChildListIterator] with ASSERTION: Null out-of-flow for placeholder
Categories
(Core :: Layout, defect)
Core
Layout
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: decoder, Unassigned)
References
Details
(5 keywords, Whiteboard: [native-crash])
Crash Data
Attachments
(4 files)
This bug was filed from the Socorro interface and is
report bp-cbbf3665-0c50-48f4-8514-9ffdc2120522 .
=============================================================
The following HTML code (save as .xhtml file), crashes Fennec Native (tested on nightly and debug build rev 95437bcc43dc) when visiting the page and then navigating away from it:
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
function aC(r, n) { if (r) { r.appendChild(n); } else { rM(n); } }
function iB(r, n) { if (r) { r.parentNode.insertBefore(n, r); } else { rM(n); } }
allNodes = [];
allNodes[0] = document.documentElement;
allNodes[50] = document.createTextNode("Foo");
allNodes[63] = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
allNodes[73] = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
allNodes[76] = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
(allNodes[73] || allNodes[72] || allNodes[63] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[76]);
allNodes[78] = document.createTextNode("\n ");
(allNodes[63] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[78]);
allNodes[88] = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
allNodes[89] = document.createTextNode("Your name");
allNodes[98] = document.createTextNode("\n ");
allNodes[125] = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
allNodes[0].style.MozColumnCount = "115";
aC(allNodes[88], allNodes[98]);
iB(allNodes[98], allNodes[63]);
allNodes[63].style.cssFloat = "right";
aC(allNodes[0], allNodes[88]);
aC(allNodes[88], allNodes[125]);
iB(allNodes[88], allNodes[73]);
function run() {
iB(allNodes[78], allNodes[89]);
aC(allNodes[76], allNodes[50]);
}
setTimeout(run, 1000);
</script>
</head>
</html>
Furthermore, this code triggers an assertion on debug builds before crashing:
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file layout/base/../generic/nsPlaceholderFrame.h, line 199
|
||
Updated•14 years ago
|
Component: General → Layout
Product: Fennec Native → Core
QA Contact: general → layout
Hardware: All → ARM
Whiteboard: [native-crash]
|
||
Comment 1•14 years ago
|
||
|
|
||
Comment 2•14 years ago
|
||
Crashes desktop when navigating away from the page as well. Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:15.0) Gecko/15.0 Firefox/15.0a1 http://hg.mozilla.org/mozilla-central/rev/c20d415ef1b5
|
|
||
Comment 3•14 years ago
|
||
Also crashes my Linux64 debug build using a fresh profile.
Before the assertion mentioned in the description, I see these two:
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file layout/base/nsLayoutUtils.cpp, line 4317
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file layout/base/nsLayoutUtils.cpp, line 4331
OS: Android → All
Hardware: ARM → All
Whiteboard: [native-crash]
|
|
||
Comment 4•14 years ago
|
||
|
|
||
Comment 5•14 years ago
|
||
The native-crash whiteboard means it happens also in FennecAndroid.
Whiteboard: [native-crash]
|
|
||
Comment 6•14 years ago
|
||
Somewhat simplified test...
|
||
Comment 7•14 years ago
|
||
Before crashing, this triggers:
###!!! ASSERTION: null parameters passed in: 'nsnull != aFrame && nsnull != aState', file layout/base/nsFrameManager.cpp, line 1747
|
||
Comment 8•14 years ago
|
||
Assigning to Mats (as he's also the assignee on bug 772320) and setting for tracking 15 since this is a regression in 15 that has a reproducible crash we'd prefer not to ship with.
|
|
||
Comment 9•14 years ago
|
||
At this stage in the cycle, we're about to go to build on our last beta for FF15 so I'm moving the tracking for this to 16 in the hopes that we can still get a fix here for a reproducible crash.
tracking-firefox16:
--- → +
|
|
||
Updated•14 years ago
|
Assignee: matspal → nobody
|
|
||
Comment 10•13 years ago
|
||
Spoke with the team - won't be able to fix this in a low risk fashion, and the crash volume here isn't bad. Untracking for release.
|
|
||
Comment 11•12 years ago
|
||
I can't reproduce this in a recent Nightly, nor a local ASAN build, on Linux64.
There's been at least one fix a while ago (involving nsOverflowContinuationTracker
and deleting column next-in-flows) that might have fixed this bug.
Can anyone else still repro this crash?
(bug 772320 have a couple of STR too)
Flags: in-testsuite?
Keywords: qawanted
|
|
||
Comment 12•12 years ago
|
||
I can still reproduce the crash with attachment 626336 [details] testcase 3 (close to crash) on Firefox31b9.
But not crash on Aurora32.0a2 and Nightly33.0a1.
|
|
||
Comment 13•10 years ago
|
||
Sounds like this is WFM on trunk
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
|
||
Comment 14•10 years ago
|
||
|
|
||
Updated•10 years ago
|
Flags: in-testsuite? → in-testsuite+
|
||
Comment 15•10 years ago
|
||
| bugherder | ||
You need to log in
before you can comment on or make changes to this bug.
Description
•