Closed Bug 772320 Opened 8 years ago Closed 6 years ago

crash in nsFrameManager::CaptureFrameState

Categories

(Core :: Layout: Form Controls, defect, critical)

15 Branch
x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox15 - wontfix
firefox16 - affected

People

(Reporter: alice0775, Unassigned)

References

Details

(Keywords: crash, regression, reproducible)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-565cebc1-8395-45ef-9d35-022bd2120710 .
============================================================= 

When I test Bug 757413 Testcase 2 attachment 626114 [details],
click on the combobox and then close tab to crash


STR:
1. Open testcase2 attachment 626114 [details] in New tab
2. Click Box at the Top-Left
3. Close tab

Actual Results:
Crashes.

Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/6fe7dd2f8f57
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120510021321
Bad:
http://hg.mozilla.org/mozilla-central/rev/b7b6565d12a0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120510050721
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6fe7dd2f8f57&tochange=b7b6565d12a0

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/c564df3858c3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120509180121
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/021f722e8022
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120509185221
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c564df3858c3&tochange=021f722e8022

Suspected: Bug 751012
Hmm, maybe Mats can work on this?
Assignee: nobody → matspal
Keywords: regression
The suspected bug is from bz's landing, so CCing him as well.
So I see several asserts on this testcase, then a crash during reflow due to having a placeholder that's not pointing to an out-of-flow:

###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4413
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4413
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4427
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4427
###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../mozilla/layout/generic/nsFrame.cpp, line 594
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 167
And the reflow is a reflow flush from nsComboboxControlFrame::ShowList.  And I get this when I just click on the combobox; I never get a chance to try closing the tab.

That looks like the crash in bug 757413 to me.

It's _possible_ that you're not seeing that crash but seeing some other crash from the broken frame tree that bug is clearly creating...  It really doesn't seem to be worth worrying about until we fix the already-known crash.
Blocks: 757413
Depends on: 781148
We'll keep tracking this for 16 but have to wontfix for 15 since we're a day away from our final Beta.
(and will likely untrack for 16 if necessary given the low volume, although that'd be a shame for a reproducible bug like this)
The float (color red), is inside a :-moz-column-content continuation
(lime), where the placeholder lives in an earlier continuation.

I think we already have a bug on this somewhere where we analyzed
the problem and concluded the problem was that nsColumnsetFrame
needs to know about nsOverflowContinuationTracker when it deletes
column next-in-flows.  Can't find the bug right now though.
This is probably not easy to fix so I won't have time to do this for Fx16.
Assignee: matspal → nobody
Blocks: 783228
Blocks: 772306
Bug 724978 have some related information.
A fix for this is believed to be risky, and we think this is a longstanding issue (while the test case itself is new). Untracking for release.
This crash is still affecting nightly, and affects real websites not just cooked examples.  Firefox 18 is now out, and could this bug please be reconsidered for firefox 19,20, or 21?  If there are not the resources to fix this then perhaps -moz-column-* should be disabled by default until this bug is fixed?
And also I can reproduce the crash in Nightly21.0a1
http://hg.mozilla.org/mozilla-central/rev/36525224b14e
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130212 Firefox/21.0 ID:20130212031120

STR
1. Open  Bug 840787 attachment 713173 [details]
2. Nabigation back or Exit Browser

Actual Results;
Crash with crash sig bp-380a64c5-1152-4990-a79e-6b4622130213
I cannot reproduce these crashes in Firefox31.0b9, Aurora32.0a2 and Nightly33.0a1
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.