Closed
Bug 394173
Opened 17 years ago
Closed 17 years ago
Crash [@ nsFrameList::InsertFrame] with rtl stuff, position fixed and unicode-bidi
Categories
(Core :: Layout: Text and Fonts, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: martijn.martijn, Assigned: smontagu)
References
Details
(4 keywords)
Crash Data
Attachments
(1 file)
|
(deleted),
text/html
|
Details |
See testcase, which crashes current trunk build within 200ms.
This regressed between 2007-05-28 and 2007-05-29, I guess a regression from bug 365130, somehow.
The iframe content consists of this:
<html>
<head>
<style>
div::first-letter { }
span::after { content:"before text"; }
</style>
</head>
<body>
<div style="position: fixed; direction: rtl;">
<span style=" direction: ltr; unicode-bidi: bidi-override; font-size: 70px; ">
<span style="display: table; position: fixed;"></span>
</span>
</div>
<script>
function doe(i){
document.documentElement.setAttribute('style', '');
}
setTimeout(doe,100);
</script>
</body>
</html>
http://crash-stats.mozilla.com/report/index/82253cb5-563b-11dc-8b16-001a4bd46e84
0 nsFrameList::InsertFrame(nsIFrame*, nsIFrame*, nsIFrame*) mozilla/layout/generic/nsFrameList.cpp:176
1 nsInlineFrame::PullOneFrame(nsPresContext*, nsInlineFrame::InlineReflowState&, int*) mozilla/layout/generic/nsInlineFrame.cpp:711
2 nsInlineFrame::ReflowFrames(nsPresContext*, nsHTMLReflowState const&, nsInlineFrame::InlineReflowState&, nsHTMLReflowMetrics&, unsigned int&) mozilla/layout/generic/nsInlineFrame.cpp:491
3 nsInlineFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) mozilla/layout/generic/nsInlineFrame.cpp:385
4 nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, int&) mozilla/layout/generic/nsLineLayout.cpp:891
5 nsBlockFrame::ReflowInlineFrame(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) mozilla/layout/generic/nsBlockFrame.cpp:3521
6 nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, int*, LineReflowStatus*, int) mozilla/layout/generic/nsBlockFrame.cpp:3341
7 nsBlockFrame::ReflowInlineFrames(nsBlockReflowState&, nsLineList_iterator, int*) mozilla/layout/generic/nsBlockFrame.cpp:3185
8 nsBlockFrame::ReflowLine(nsBlockReflowState&, nsLineList_iterator, int*) mozilla/layout/generic/nsBlockFrame.cpp:2218
9 nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) mozilla/layout/generic/nsBlockFrame.cpp:1825
10 nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) mozilla/layout/generic/nsBlockFrame.cpp:920
11 nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, nsHTMLReflowState const&, int, int, nsIFrame*, unsigned int&, nsRect*) mozilla/layout/generic/nsAbsoluteContainingBlock.cpp:375
12 nsAbsoluteContainingBlock::Reflow(nsIFrame*, nsPresContext*, nsHTMLReflowState const&, int, int, int, int, nsRect*) mozilla/layout/generic/nsAbsoluteContainingBlock.cpp:159
13 ViewportFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) mozilla/layout/generic/nsViewportFrame.cpp:322
14 PresShell::DoReflow(nsIFrame*) mozilla/layout/base/nsPresShell.cpp:6059
15 PresShell::ProcessReflowCommands(int) mozilla/layout/base/nsPresShell.cpp:6172
16 PresShell::DoFlushPendingNotifications(mozFlushType, int) mozilla/layout/base/nsPresShell.cpp:4408
17 PresShell::ReflowEvent::Run() mozilla/layout/base/nsPresShell.cpp:5935
18 nsThread::ProcessNextEvent(int, int*) mozilla/xpcom/threads/nsThread.cpp:490
19 NS_ProcessNextEvent_P(nsIThread*, int) nsThreadUtils.cpp:227
20 nsBaseAppShell::Run() mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
21 nsAppStartup::Run() mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
22 XRE_main mozilla/toolkit/xre/nsAppRunner.cpp:3069
23 main mozilla/browser/app/nsBrowserApp.cpp:153
24 WinMain mozilla/browser/app/nsBrowserApp.cpp:166
25 __tmainCRTStartup crtexe.c:589
|
Assignee | |
Comment 1•17 years ago
|
||
The latest patch in bug 382422 fixes this. For the record, before the crash in an unpatched build I get:
###!!! ASSERTION: unexpected flow: 'mFrames.ContainsFrame(nextInFlow)', file /home/smontagu/mozwork/debugtree/mozilla/layout/generic/nsInlineFrame.cpp, line 462
###!!! ASSERTION: StealFrame failure: 'NS_SUCCEEDED(rv)', file /home/smontagu/mozwork/debugtree/mozilla/layout/generic/nsContainerFrame.cpp, line 1026
Assignee: mozilla → nobody
Component: MailNews: BiDi Hebrew & Arabic → Layout: BiDi Hebrew & Arabic
Depends on: 382422
QA Contact: giladehven → layout.bidi
|
|
Assignee | |
Updated•17 years ago
|
Assignee: nobody → smontagu
|
|
Assignee | |
Comment 2•17 years ago
|
||
Fixed by bug 382422
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
||
Updated•17 years ago
|
Flags: in-testsuite?
|
Reporter | |
Comment 3•17 years ago
|
||
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007090304 Minefield/3.0a8pre
Status: RESOLVED → VERIFIED
|
|
Assignee | |
Updated•17 years ago
|
Flags: in-testsuite? → in-testsuite+
|
||
Comment 4•17 years ago
|
||
Mass-assigning the new rtl keyword to RTL-related (see bug 349193).
Keywords: rtl
Component: Layout: BiDi Hebrew & Arabic → Layout: Text
QA Contact: layout.bidi → layout.fonts-and-text
|
||
Updated•13 years ago
|
Crash Signature: [@ nsFrameList::InsertFrame]
You need to log in
before you can comment on or make changes to this bug.
Description
•