Closed Bug 1116104 Opened 6 years ago Closed 6 years ago

crash in AdjustAppendParentForAfterContent

Categories

(Core :: Layout, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla37

People

(Reporter: martijn.martijn, Assigned: mats)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(2 files)

See testcase, which crashes in current trunk build.
Could this be a regression from bug 508665?

This bug was filed from the Socorro interface and is 
report bp-389ddc57-2647-4e89-82ff-69c9b2141229.
=============================================================
0 	XUL 	AdjustAppendParentForAfterContent 	layout/base/nsLayoutUtils.cpp
1 	XUL 	nsCSSFrameConstructor::GetInsertionPrevSibling(nsCSSFrameConstructor::InsertionPoint*, nsIContent*, bool*, bool*, nsIContent*, nsIContent*) 	layout/base/nsCSSFrameConstructor.cpp
2 	XUL 	nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) 	layout/base/nsCSSFrameConstructor.cpp
3 	XUL 	nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, bool, nsCSSFrameConstructor::RemoveFlags, nsIContent**) 	layout/base/nsCSSFrameConstructor.cpp
4 	XUL 	mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) 	layout/base/RestyleManager.cpp
5 	XUL 	mozilla::RestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint) 	layout/base/RestyleManager.cpp
6 	XUL 	mozilla::RestyleManager::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint) 	layout/base/RestyleManager.cpp
7 	XUL 	mozilla::RestyleTracker::ProcessOneRestyle(mozilla::dom::Element*, nsRestyleHint, nsChangeHint) 	layout/base/RestyleTracker.cpp
8 	XUL 	mozilla::RestyleTracker::DoProcessRestyles() 	layout/base/RestyleTracker.cpp
9 	XUL 	mozilla::RestyleManager::ProcessPendingRestyles() 	layout/base/RestyleTracker.h
10 	XUL 	PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) 	layout/base/nsPresShell.cpp
(In reply to Martijn Wargers [:mwargers] (QA) from comment #0)
> Could this be a regression from bug 508665?

That seems likely.

(gdb)
#1  0x00007ffff063dd75 in AdjustAppendParentForAfterContent (...) 
6073            parent = nsLayoutUtils::LastContinuationWithChild(do_QueryFrame(child));
(gdb) p child
$1 = (nsIFrame *) 0x7fffb1efb4c8
(gdb) p child->DumpFrameTreeLimited()
TableCol(colgroup)(1)@7fffb1efb4c8 {0,0,0,0} [state=0000000020000402] [content=7fffafc4c550] [sc=7fffb1efb420:-moz-table-column]

nsTableColFrame isn't a nsContainerFrame, so do_QueryFrame returns null.
Blocks: 508665
OS: Mac OS X → All
QA Contact: mats
Attached patch fix+crashtestSplinter Review
https://tbpl.mozilla.org/?tree=Try&rev=7207675497bd
Assignee: nobody → mats
Attachment #8542190 - Flags: review?(roc)
QA Contact: mats
https://hg.mozilla.org/mozilla-central/rev/31b943721eba
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla37
You need to log in before you can comment on or make changes to this bug.