Closed Bug 914501 Opened 7 years ago Closed 4 years ago

Crash [@ nsIFrame::IsFloating] with -moz-column, float, clear

Categories

(Core :: Layout, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla44
Tracking Status
firefox22 --- affected
firefox23 --- affected
firefox24 --- affected
firefox25 --- affected
firefox26 --- affected

People

(Reporter: jruderman, Assigned: mats)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, testcase, Whiteboard: [fixed by bug 790260])

Crash Data

Attachments

(2 files)

Attached file testcase
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file layout/base/nsLayoutUtils.cpp, line 4883

###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file layout/generic/nsFrame.cpp, line 614

###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file layout/base/../generic/nsPlaceholderFrame.h, line 162

Crash [@ nsIFrame::IsFloating]
ASan:
[@ mozilla::ElementRestyler::RestyleContentChildren]

Debug:
[@ nsIFrame::IsFloating]

Nightly:
bp-4a2c4153-c512-4441-a6c0-814962130910
[@ mozilla::layout::FrameChildListIterator::FrameChildListIterator(nsIFrame const*)]
Crash Signature: [@ mozilla::ElementRestyler::RestyleContentChildren] [@ nsIFrame::IsFloating] [@ [@ mozilla::layout::FrameChildListIterator::FrameChildListIterator(nsIFrame const*) ]]
Crash Signature: [@ mozilla::ElementRestyler::RestyleContentChildren] [@ nsIFrame::IsFloating] [@ [@ mozilla::layout::FrameChildListIterator::FrameChildListIterator(nsIFrame const*) ]] → [@ mozilla::ElementRestyler::RestyleContentChildren] [@ nsIFrame::IsFloating] [@ mozilla::layout::FrameChildListIterator::FrameChildListIterator(nsIFrame const*) ]
Attached file stacks
There are 2 regressions.
#1 Hang, suspected: Bug 810726
#2 Crash, suspected: Bug 857324

#1 Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/ee4879719f78
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130307 Firefox/22.0 ID:20130307030926
Hang
http://hg.mozilla.org/mozilla-central/rev/71395a927025
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130307 Firefox/22.0 ID:20130307091952
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ee4879719f78&tochange=71395a927025

#1 Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/9b52f3a5b53b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130306 Firefox/22.0 ID:20130306054800
Hang
http://hg.mozilla.org/integration/mozilla-inbound/rev/c55ce1a65e1d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130306 Firefox/22.0 ID:20130306065000
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=9b52f3a5b53b&tochange=c55ce1a65e1d
Suspected:
f5b6b9b0157d	Scott Johnson — Bug 810726: Simplify logic for handling too many columns to prevent crash. [r=roc]


#2 Regression window(m-c)
Hang
http://hg.mozilla.org/mozilla-central/rev/1c5977e8d52f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424051650
Crash
http://hg.mozilla.org/mozilla-central/rev/07e17dd7813b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424131851
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1c5977e8d52f&tochange=07e17dd7813b

#2 Regression window(m-i)
Hang
http://hg.mozilla.org/integration/mozilla-inbound/rev/4b7de1f2b4a0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424064250
Crash
http://hg.mozilla.org/integration/mozilla-inbound/rev/52127bafd50b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20130424 Firefox/23.0 ID:20130424080350
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4b7de1f2b4a0&tochange=52127bafd50b
Suspected:
52127bafd50b	Scott Johnson — Bug 857324: Make column set reflow continue without balancing rather than restarting if computed height is exceeded. [r=mats]
Blocks: 857324
I think the fix I just landed for bug 790260 might help here.
Please test again when that fix reaches Nightly.
Depends on: 790260
Flags: needinfo?(alice0775)
I can verify to fix.
I can not reproduce the crach and the hang on Nightly 2015-10-08.

https://hg.mozilla.org/mozilla-central/rev/a955ea9382afedd66ea0da21fcd2932465168d84
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0 ID:20151008030232
Flags: needinfo?(alice0775)
Lovely, thanks for testing.  Resolving as fixed by bug 790260.
Assignee: nobody → mats
Status: NEW → RESOLVED
Closed: 4 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Whiteboard: [fixed by bug 790260]
Target Milestone: --- → mozilla44
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.