Loading the attachment in Firefox (opt or debug) makes Firefox hang. Based on console output, it seems like some widths keeps increasing by 60 during the hang: ###!!! ASSERTION: bad width: 'Not Reached', nsLineLayout.cpp, line 180 Block(option)(1)@0x2eeb4ec: Init: bad caller: width WAS 5412732(0x52977c) ###!!! ASSERTION: bad width: 'Not Reached', nsLineLayout.cpp, line 180 Block(option)(3)@0x2eeb75c: Init: bad caller: width WAS 5412792(0x5297b8) ###!!! ASSERTION: bad width: 'Not Reached', nsLineLayout.cpp, line 180 Block(option)(1)@0x2eeb4ec: Init: bad caller: width WAS 5412852(0x5297f4)

We're spinning around in the loops in nsStackLayout::Layout: http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/xul/base/src/nsStackLayout.cpp&rev=1.35&root=/cvsroot&mark=252,256,304,305,333,292#252 The reason is that the first child grows (with the outline) which makes the desired size for the second child slightly larger, then the second child grows from that (again with the outline), so we adjust again and reflow the first child... The root of the problem seems to be nsFrame::BoxReflow which adds in the overflow rect to the desired size, resulting in FinishReflowChild() eventually setting nsIFrame::mRect to a rect that is not actually the border rect... http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/generic/nsFrame.cpp&rev=3.719&root=/cvsroot&mark=6216,6222,6223,6232,6234,6253,6272,6273#6213

This sort of fixes it, but I have a better fix I think...

The fix is the three lines where I added "- outline", the rest is just removal of dead code. The idea is that we should not grow to accommodate our own outline, just overflow from children.

You might want to check whether your patch fixes this testcase as well. Also see bug 375180.

(In reply to comment #5) > You might want to check whether your patch fixes this testcase as well. It didn't. I think we really need to limit the resizing that goes on in nsStackLayout::Layout too. This patch does that and it fixes all testcases, also the one in bug 375180.

I'm getting the same kind of hangs with -moz-box-shadow too, fwiw.

WFM on trunk.

Crashtest: http://hg.mozilla.org/mozilla-central/rev/b64a7e4a35e2