Bug 810726: Rework logic in nsColumnSetFrame for handling overflow to prevent infinite loop problems. [r=roc]
☠☠ backed out by 1f765c27d9a4 ☠ ☠
authorScott Johnson <sjohnson@mozilla.com>
Wed, 13 Feb 2013 14:39:40 -0600
changeset 131671 a0db951f9f08404b4b0b53d1a8ffedff06d8094a
parent 131670 e02c8045c228f609d2144ddb57e3e311ec7c86f5
child 131672 6f8fc3c171840e2d50ebe29de9e5bff9e5ecf3be
push id2323
push userbbajaj@mozilla.com
push dateMon, 01 Apr 2013 19:47:02 +0000
treeherdermozilla-beta@7712be144d91 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs810726
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 810726: Rework logic in nsColumnSetFrame for handling overflow to prevent infinite loop problems. [r=roc]
layout/generic/crashtests/810726.html
layout/generic/crashtests/b810726-2.html
layout/generic/crashtests/crashtests.list
layout/generic/nsColumnSetFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/810726.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <head>
+  </head>
+  <body>
+    <iframe width="1200" height="1024" src="810726-2.html">
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/b810726-2.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html>
+<head>
+<style>
+  .outer-bound {
+    max-width: 980px;
+  }
+
+  .cols {
+    -moz-column-width: 700px;
+  }
+</style>
+</head>
+<body>
+<div class="outer-bound">
+  <div class="cols">
+    <p>There once was a guy.</p>
+  </div>
+</div>
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -423,8 +423,9 @@ test-pref(layout.css.flexbox.enabled,tru
 test-pref(layout.css.flexbox.enabled,true) load 737313-3.html
 load 762764-1.html
 load 786740-1.html
 asserts(8) test-pref(layout.css.flexbox.enabled,true) load 798020-1.html
 test-pref(layout.css.flexbox.enabled,true) load 798235-1.html
 test-pref(layout.css.flexbox.enabled,true) load 799207-1.html
 asserts(12) test-pref(layout.css.flexbox.enabled,true) load 799207-2.html
 test-pref(layout.css.flexbox.enabled,true) load 804089-1.xhtml
+load 810726.html
--- a/layout/generic/nsColumnSetFrame.cpp
+++ b/layout/generic/nsColumnSetFrame.cpp
@@ -730,34 +730,31 @@ nsColumnSetFrame::ReflowChildren(nsHTMLR
           aConfig.mBalanceColCount < INT32_MAX) {
         // We overflowed vertically, but have not exceeded the number
         // of columns. If we're balancing, then we should try reverting
         // to auto instead.
         aColData.mShouldRevertToAuto = true;
       }
 
       if (columnCount >= aConfig.mBalanceColCount) {
-        if (contentBottom >= aReflowState.availableHeight) {
+        if (contentBottom > aReflowState.mComputedMaxHeight ||
+            contentBottom > aReflowState.ComputedHeight()) {
+            aColData.mShouldRevertToAuto = true;
+        } else {
           // No more columns allowed here. Stop.
           aStatus |= NS_FRAME_REFLOW_NEXTINFLOW;
           kidNextInFlow->AddStateBits(NS_FRAME_IS_DIRTY);
           // Move any of our leftover columns to our overflow list. Our
           // next-in-flow will eventually pick them up.
           const nsFrameList& continuationColumns = mFrames.RemoveFramesAfter(child);
           if (continuationColumns.NotEmpty()) {
             SetOverflowFrames(PresContext(), continuationColumns);
           }
           child = nullptr;
           break;
-        } else if (contentBottom > aReflowState.mComputedMaxHeight ||
-                   contentBottom > aReflowState.ComputedHeight()) {
-          aColData.mShouldRevertToAuto = true;
-        } else {
-          // The number of columns required is too high.
-          allFit = false;
         }
       }
     }
 
     if (PresContext()->HasPendingInterrupt()) {
       // Stop the loop now while |child| still points to the frame that bailed
       // out.  We could keep going here and condition a bunch of the code in
       // this loop on whether there's an interrupt, or even just keep going and