914501 - Crash [@ nsIFrame::IsFloating] with -moz-column, float, clear

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file layout/base/nsLayoutUtils.cpp, line 4883

###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file layout/generic/nsFrame.cpp, line 614

###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file layout/base/../generic/nsPlaceholderFrame.h, line 162

Crash [@ nsIFrame::IsFloating]

Comment 1

[Jesse Ruderman]

ASan:
[@ mozilla::ElementRestyler::RestyleContentChildren]

Debug:
[@ nsIFrame::IsFloating]

Nightly:
bp-4a2c4153-c512-4441-a6c0-814962130910
[@ mozilla::layout::FrameChildListIterator::FrameChildListIterator(nsIFrame const*)]

Comment 2

[Jesse Ruderman]

Attachment: stacks

Comment 3

[Alice0775 White]

There are 2 regressions.
#1 Hang, suspected: Bug 810726
#2 Crash, suspected: Bug 857324

#1 Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/ee4879719f78
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130307 Firefox/22.0 ID:20130307030926
Hang
http://hg.mozilla.org/mozilla-central/rev/71395a927025
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130307 Firefox/22.0 ID:20130307091952
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ee4879719f78&tochange=71395a927025

#1 Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/9b52f3a5b53b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130306 Firefox/22.0 ID:20130306054800
Hang
http://hg.mozilla.org/integration/mozilla-inbound/rev/c55ce1a65e1d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130306 Firefox/22.0 ID:20130306065000
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=9b52f3a5b53b&tochange=c55ce1a65e1d
Suspected:
f5b6b9b0157d	Scott Johnson — Bug 810726: Simplify logic for handling too many columns to prevent crash. [r=roc]


#2 Regression window(m-c)
Hang
http://hg.mozilla.org/mozilla-central/rev/1c5977e8d52f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424051650
Crash
http://hg.mozilla.org/mozilla-central/rev/07e17dd7813b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424131851
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1c5977e8d52f&tochange=07e17dd7813b

#2 Regression window(m-i)
Hang
http://hg.mozilla.org/integration/mozilla-inbound/rev/4b7de1f2b4a0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424064250
Crash
http://hg.mozilla.org/integration/mozilla-inbound/rev/52127bafd50b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424080350
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4b7de1f2b4a0&tochange=52127bafd50b
Suspected:
52127bafd50b	Scott Johnson — Bug 857324: Make column set reflow continue without balancing rather than restarting if computed height is exceeded. [r=mats]

Comment 4

[Mats Palmgren (inactive)]

I think the fix I just landed for bug 790260 might help here.
Please test again when that fix reaches Nightly.

Comment 5

[Alice0775 White]

I can verify to fix.
I can not reproduce the crach and the hang on Nightly 2015-10-08.

https://hg.mozilla.org/mozilla-central/rev/a955ea9382afedd66ea0da21fcd2932465168d84
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0 ID:20151008030232

Comment 6

[Mats Palmgren (inactive)]

Lovely, thanks for testing.  Resolving as fixed by bug 790260.

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c3732cb29e13

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c3732cb29e13