Closed
Bug 840787
Opened 11 years ago
Closed 11 years ago
Crash with -moz-column, float, changing text
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Assigned: jruderman)
References
Details
(Keywords: assertion, crash, testcase)
Crash Data
Attachments
(2 files)
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../layout/base/nsLayoutUtils.cpp, line 4808 ###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../layout/generic/nsFrame.cpp, line 633 ###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../layout/base/../generic/nsPlaceholderFrame.h, line 162 This might just be another symptom of bug 600100.
|
Assignee | |
Comment 1•11 years ago
|
||
|
||
Updated•11 years ago
|
Crash Signature: [@ nsLayoutUtils::AssertTreeOnlyEmptyNextInFlows(nsIFrame*)]
|
||
Comment 2•11 years ago
|
||
FYI The testcase attachment 713173 [details] crashes. (see Bug 772320 Comment#12 and regressed by Bug 751012)
|
|
Assignee | |
Updated•11 years ago
|
Attachment #713173 -
Attachment description: testcase → testcase (crashes Firefox when loaded)
|
||
Comment 3•11 years ago
|
||
Testcase works for me in a local m-c debug build on Linux64, without any assertions, and also works in an ASan build.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
|
|
||
Comment 4•11 years ago
|
||
Crash test: https://hg.mozilla.org/integration/mozilla-inbound/rev/e636b91b1cbb
Flags: in-testsuite? → in-testsuite+
|
||
Comment 5•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/e636b91b1cbb
Assignee: nobody → jruderman
You need to log in
before you can comment on or make changes to this bug.
Description
•