827076 - Null crash in nsBox::DoesNeedRecalc with flexbox

Status: RESOLVED DUPLICATE of bug 812822

(Core :: Layout, defect)

Description

[Abhishek Arya]

==13443== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8b9c70316c sp 0x7fffdb631d10 bp 0x7fffdb631e70 T0)
AddressSanitizer can not provide additional info.
    #0 0x7f8b9c70316b in nsBox::DoesNeedRecalc(nsSize const&) layout/xul/base/src/nsBox.cpp:386
    #1 0x7f8b9c4a4a9f in nsVideoFrame::GetVideoIntrinsicSize(nsRenderingContext*) layout/generic/nsVideoFrame.cpp:521
    #2 0x7f8b9c1c0d4c in nsLayoutUtils::ComputeWidthValue(nsRenderingContext*, nsIFrame*, int, int, int, nsStyleCoord const&) layout/base/nsLayoutUtils.cpp:2829
Stats: 213M malloced (181M for red zones) by 261628 calls
Stats: 33M realloced by 13421 calls
Stats: 179M freed by 139313 calls
Stats: 139M really freed by 113614 calls
Stats: 204M (52272 full pages) mmaped in 386 calls
  mmaps   by size class: 6:81910; 7:61425; 8:22517; 9:12276; 10:4599; 11:6375; 12:1024; 13:704; 14:512; 15:208; 16:584; 17:460; 18:30; 19:33; 20:20;
  mallocs by size class: 6:101015; 7:79689; 8:35801; 9:20565; 10:6632; 11:10337; 12:1830; 13:1599; 14:1389; 15:325; 16:966; 17:1381; 18:41; 19:37; 20:21;
  frees   by size class: 6:58920; 7:27043; 8:20641; 9:14705; 10:3734; 11:8432; 12:1146; 13:1169; 14:1244; 15:219; 16:609; 17:1365; 18:31; 19:36; 20:19;
  rfrees  by size class: 6:51536; 7:21268; 8:17049; 9:8653; 10:2638; 11:7553; 12:906; 13:928; 14:1123; 15:164; 16:479; 17:1280; 18:26; 19:10; 20:1;
Stats: malloc large: 2771 small slow: 3337
==13443== ABORTING

Testcase::
<audio>>>><style>
* { text-size: -29pt; display: flex;

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: reporter's testcase

Comment 2

[Daniel Holbert [:dholbert]]

Before crashing, this triggers:
###!!! ASSERTION: A box layout method was called but InitBoxMetrics was never called: 'metrics', file /scratch/work/builds/mozilla-central/mozilla-central.12-12-07.08-38/mozilla/layout/generic/nsFrame.cpp, line 8102
which is also triggered by bug 812822's testcase (per bug 812822 comment 0).

Also, my posted patch for bug 812822 fixes this.  Marking as a dupe, since it looks like they're the same underlying problem. (an element with UA-mandated "display: -moz-box" on some of its children, which we end up converting to "display:block" because we add a flexbox style to the parent.)

Comment 3

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fd3aca14205c

Comment 4

[Ryan VanderMeulen (PTO, back July 27)]

https://hg.mozilla.org/mozilla-central/rev/fd3aca14205c

Comment 5

[Daniel Holbert [:dholbert]]

Thanks, Mats & Ryan.