1042489 - Crash [@ nsBlockReflowContext::ComputeCollapsedBStartMargin] with -moz-column, box-decoration-break: clone

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Mats Palmgren (inactive)]

Attachment: frame tree dump

We expect that a nsColumnSetFrame always has an inner frame
to hold the frames of the content children; and we do, it's
just that it still sits on the overflow list of the prev-in-flow
from the time the continuation is created until it's reflowed.

Comment 3

[Mats Palmgren (inactive)]

Attachment: fix+crashtest

Call DrainOverflowColumns() to pick up any overflow frames from our
prev-in-flow.  And do a null-check even after that b/c I suspect that
in rare cases involving overflow containers a ColumnSetFrame might
not have a child frame.

https://tbpl.mozilla.org/?tree=Try&rev=4e79913be6d4

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/feca845bb857

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/feca845bb857

Comment 6

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Setting as qe-verify- since this has a test (layout/generic/crashtests/1042489.html).