413185 - Crash [@ nsBlockFrame::CheckFloats] [@ nsFrameManager::CaptureFrameStateFor] with MathML, float

Status: RESOLVED FIXED

(Core :: MathML, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase triggers:

###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 748

###!!! ASSERTION: not in child list: 'found', file /Users/jruderman/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 1815

Crash at one of:
* nsBlockFrame::CheckFloats dereferencing 0xddddddfd
* nsFrameManager::CaptureFrameStateFor dereferencing 0x00000000.

Note that bug 399676 also has a testcase that triggers the first assertion.  Maybe it's related.

Comment 1

[Martijn Wargers (dead)]

No crash on branch.

Comment 2

[Vlad Sukhoy]

For me, if the testcase is downloaded and opened locally, there is no crash (at least in those couple of test launches I did), but the one from bugzilla crashes reliably. body.onload timing?

Comment 3

[Vlad Sukhoy]

Nevermind, saved the file with ".xml" extension instead of ".xhtml".

Comment 4

[Håkan Waara]

This doesn't crash for me in a newly-updated trunk build. I bet it was fixed with bug 399676. 

Comment 5

[Boris Zbarsky [:bzbarsky]]

Yeah, I can see that patch fixing this, since now we have our frame tree all sane.