1145768 - "Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists)" with writing-mode

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

1. Set:
     user_pref("layout.css.vertical-text.enabled", true);
2. Load the testcase in a debug build

Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists), at layout/generic/nsLineBox.h:854

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Mats Palmgren (inactive)]

This might be a security issue, so in the interest of users that have enabled
this feature I'm hiding this bug.

Comment 3

[Mats Palmgren (inactive)]

Attachment: fix

This is harmless apart from the assertion since RFindLineContaining
searches backward and only use begin() in the condition to exit the
loop.  We should always find the frame on the overflow list though,
if it's not on the principal list.

We still don't reflow the frame tree after the mutation but that
seems like a separate issue - I'll file a separate bug on that.

Comment 4

[Mats Palmgren (inactive)]

Attachment: same patch with more context

Comment 5

[Mats Palmgren (inactive)]

It's harmless apart from the assertion in DEBUG builds.

Comment 6

[Mats Palmgren (inactive)]

Attachment: frame tree

Here's the frame tree for testcase with the patch applied.
As you can see we haven't reflowed the tree properly and the
page is blank for me.  The rendering looks correct after
resizing the window though (a sideways "R").

Comment 7

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bfd05b76c3bb

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/bfd05b76c3bb

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/671d6a9302f9

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/671d6a9302f9