772320 - crash in nsFrameManager::CaptureFrameState

Status: RESOLVED WORKSFORME

(Core :: Layout: Form Controls, defect)

Description

[Alice0775 White]

This bug was filed from the Socorro interface and is 
report bp-565cebc1-8395-45ef-9d35-022bd2120710 .
============================================================= 

When I test Bug 757413 Testcase 2 attachment 626114 [details],
click on the combobox and then close tab to crash


STR:
1. Open testcase2 attachment 626114 [details] in New tab
2. Click Box at the Top-Left
3. Close tab

Actual Results:
Crashes.

Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/6fe7dd2f8f57
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120510021321
Bad:
http://hg.mozilla.org/mozilla-central/rev/b7b6565d12a0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120510050721
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6fe7dd2f8f57&tochange=b7b6565d12a0

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/c564df3858c3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120509180121
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/021f722e8022
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/15.0 Firefox/15.0a1 ID:20120509185221
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c564df3858c3&tochange=021f722e8022

Suspected: Bug 751012

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Hmm, maybe Mats can work on this?

Comment 2

[Alex Keybl [:akeybl]]

The suspected bug is from bz's landing, so CCing him as well.

Comment 3

[Boris Zbarsky [:bzbarsky]]

So I see several asserts on this testcase, then a crash during reflow due to having a placeholder that's not pointing to an out-of-flow:

###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4413
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4413
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4427
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file ../../../mozilla/layout/base/nsLayoutUtils.cpp, line 4427
###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../mozilla/layout/generic/nsFrame.cpp, line 594
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 167

Comment 4

[Boris Zbarsky [:bzbarsky]]

And the reflow is a reflow flush from nsComboboxControlFrame::ShowList.  And I get this when I just click on the combobox; I never get a chance to try closing the tab.

That looks like the crash in bug 757413 to me.

It's _possible_ that you're not seeing that crash but seeing some other crash from the broken frame tree that bug is clearly creating...  It really doesn't seem to be worth worrying about until we fix the already-known crash.

Comment 5

[Lukas Blakk [:lsblakk] use ?needinfo]

We'll keep tracking this for 16 but have to wontfix for 15 since we're a day away from our final Beta.

Comment 6

[Alex Keybl [:akeybl]]

(and will likely untrack for 16 if necessary given the low volume, although that'd be a shame for a reproducible bug like this)

Comment 7

[Mats Palmgren (inactive)]

Attachment: stack + frame dump for assertion in bug 757413 Testcase #2

The float (color red), is inside a :-moz-column-content continuation
(lime), where the placeholder lives in an earlier continuation.

I think we already have a bug on this somewhere where we analyzed
the problem and concluded the problem was that nsColumnsetFrame
needs to know about nsOverflowContinuationTracker when it deletes
column next-in-flows.  Can't find the bug right now though.

Comment 8

[Mats Palmgren (inactive)]

This is probably not easy to fix so I won't have time to do this for Fx16.

Comment 9

[Mats Palmgren (inactive)]

Bug 724978 have some related information.

Comment 10

[Alex Keybl [:akeybl]]

A fix for this is believed to be risky, and we think this is a longstanding issue (while the test case itself is new). Untracking for release.

Comment 11

[Douglas Crosher [:dougc]]

This crash is still affecting nightly, and affects real websites not just cooked examples.  Firefox 18 is now out, and could this bug please be reconsidered for firefox 19,20, or 21?  If there are not the resources to fix this then perhaps -moz-column-* should be disabled by default until this bug is fixed?

Comment 12

[Alice0775 White]

And also I can reproduce the crash in Nightly21.0a1
http://hg.mozilla.org/mozilla-central/rev/36525224b14e
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130212 Firefox/21.0 ID:20130212031120

STR
1. Open  Bug 840787 attachment 713173 [details]
2. Nabigation back or Exit Browser

Actual Results;
Crash with crash sig bp-380a64c5-1152-4990-a79e-6b4622130213

Comment 13

[Alice0775 White]

I cannot reproduce these crashes in Firefox31.0b9, Aurora32.0a2 and Nightly33.0a1