Closed Bug 772320 Opened 8 years ago Closed 6 years ago
crash in ns
Frame Manager::Capture Frame State
21.15 KB, text/html
This bug was filed from the Socorro interface and is report bp-565cebc1-8395-45ef-9d35-022bd2120710 . ============================================================= When I test Bug 757413 Testcase 2 attachment 626114 [details], click on the combobox and then close tab to crash STR: 1. Open testcase2 attachment 626114 [details] in New tab 2. Click Box at the Top-Left 3. Close tab Actual Results: Crashes. Regression window(m-c) Good: http://hg.mozilla.org/mozilla-central/rev/6fe7dd2f8f57 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120510021321 Bad: http://hg.mozilla.org/mozilla-central/rev/b7b6565d12a0 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120510050721 Pushlog: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6fe7dd2f8f57&tochange=b7b6565d12a0 Regression window(m-i) Good: http://hg.mozilla.org/integration/mozilla-inbound/rev/c564df3858c3 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120509180121 Bad: http://hg.mozilla.org/integration/mozilla-inbound/rev/021f722e8022 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120509185221 Pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c564df3858c3&tochange=021f722e8022 Suspected: Bug 751012
Hmm, maybe Mats can work on this?
The suspected bug is from bz's landing, so CCing him as well.
So I see several asserts on this testcase, then a crash during reflow due to having a placeholder that's not pointing to an out-of-flow: ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4413 ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4413 ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4427 ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4427 ###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../mozilla/layout/generic/nsFrame.cpp, line 594 ###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 167
And the reflow is a reflow flush from nsComboboxControlFrame::ShowList. And I get this when I just click on the combobox; I never get a chance to try closing the tab. That looks like the crash in bug 757413 to me. It's _possible_ that you're not seeing that crash but seeing some other crash from the broken frame tree that bug is clearly creating... It really doesn't seem to be worth worrying about until we fix the already-known crash.
We'll keep tracking this for 16 but have to wontfix for 15 since we're a day away from our final Beta.
(and will likely untrack for 16 if necessary given the low volume, although that'd be a shame for a reproducible bug like this)
The float (color red), is inside a :-moz-column-content continuation (lime), where the placeholder lives in an earlier continuation. I think we already have a bug on this somewhere where we analyzed the problem and concluded the problem was that nsColumnsetFrame needs to know about nsOverflowContinuationTracker when it deletes column next-in-flows. Can't find the bug right now though.
This is probably not easy to fix so I won't have time to do this for Fx16.
Assignee: matspal → nobody
Bug 724978 have some related information.
A fix for this is believed to be risky, and we think this is a longstanding issue (while the test case itself is new). Untracking for release.
This crash is still affecting nightly, and affects real websites not just cooked examples. Firefox 18 is now out, and could this bug please be reconsidered for firefox 19,20, or 21? If there are not the resources to fix this then perhaps -moz-column-* should be disabled by default until this bug is fixed?
And also I can reproduce the crash in Nightly21.0a1 http://hg.mozilla.org/mozilla-central/rev/36525224b14e Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130212 Firefox/21.0 ID:20130212031120 STR 1. Open Bug 840787 attachment 713173 [details] 2. Nabigation back or Exit Browser Actual Results; Crash with crash sig bp-380a64c5-1152-4990-a79e-6b4622130213
I cannot reproduce these crashes in Firefox31.0b9, Aurora32.0a2 and Nightly33.0a1
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.