1116104 - crash in AdjustAppendParentForAfterContent

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (zombie)]

Attachment: 63336ae8-6e3c-11dd-9294-001cc45a2c28_useless_stack_.htm

See testcase, which crashes in current trunk build.
Could this be a regression from bug 508665?

This bug was filed from the Socorro interface and is 
report bp-389ddc57-2647-4e89-82ff-69c9b2141229.
=============================================================
0 	XUL 	AdjustAppendParentForAfterContent 	layout/base/nsLayoutUtils.cpp
1 	XUL 	nsCSSFrameConstructor::GetInsertionPrevSibling(nsCSSFrameConstructor::InsertionPoint*, nsIContent*, bool*, bool*, nsIContent*, nsIContent*) 	layout/base/nsCSSFrameConstructor.cpp
2 	XUL 	nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) 	layout/base/nsCSSFrameConstructor.cpp
3 	XUL 	nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, bool, nsCSSFrameConstructor::RemoveFlags, nsIContent**) 	layout/base/nsCSSFrameConstructor.cpp
4 	XUL 	mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) 	layout/base/RestyleManager.cpp
5 	XUL 	mozilla::RestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint) 	layout/base/RestyleManager.cpp
6 	XUL 	mozilla::RestyleManager::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint) 	layout/base/RestyleManager.cpp
7 	XUL 	mozilla::RestyleTracker::ProcessOneRestyle(mozilla::dom::Element*, nsRestyleHint, nsChangeHint) 	layout/base/RestyleTracker.cpp
8 	XUL 	mozilla::RestyleTracker::DoProcessRestyles() 	layout/base/RestyleTracker.cpp
9 	XUL 	mozilla::RestyleManager::ProcessPendingRestyles() 	layout/base/RestyleTracker.h
10 	XUL 	PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) 	layout/base/nsPresShell.cpp

Comment 1

[Mats Palmgren (PTO)]

(In reply to Martijn Wargers [:mwargers] (QA) from comment #0)
> Could this be a regression from bug 508665?

That seems likely.

(gdb)
#1  0x00007ffff063dd75 in AdjustAppendParentForAfterContent (...) 
6073            parent = nsLayoutUtils::LastContinuationWithChild(do_QueryFrame(child));
(gdb) p child
$1 = (nsIFrame *) 0x7fffb1efb4c8
(gdb) p child->DumpFrameTreeLimited()
TableCol(colgroup)(1)@7fffb1efb4c8 {0,0,0,0} [state=0000000020000402] [content=7fffafc4c550] [sc=7fffb1efb420:-moz-table-column]

nsTableColFrame isn't a nsContainerFrame, so do_QueryFrame returns null.

Comment 2

[Mats Palmgren (PTO)]

Attachment: fix+crashtest

https://tbpl.mozilla.org/?tree=Try&rev=7207675497bd

Comment 3

[Mats Palmgren (PTO)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/31b943721eba

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/31b943721eba