Closed Bug 1153695 Opened 8 years ago Closed 7 years ago

"Assertion failure: !nif || (!mFloats.ContainsFrame(nif) && !mFrames.ContainsFrame(nif))" with -moz-column

Categories

(Core :: Layout, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla45
Tracking Status
firefox40 --- affected
firefox45 --- fixed

People

(Reporter: jruderman, Assigned: MatsPalmgren_bugz)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(6 files)

Attached file testcase
Assertion failure: !nif || (!mFloats.ContainsFrame(nif) && !mFrames.ContainsFrame(nif)), at layout/generic/nsBlockFrame.cpp:7419
Attached file stack
Is this a recent regression?  It seems I can reproduce it my Aurora tree but not in Beta.
OS: Mac OS X → All
Hardware: x86_64 → All
Local bisection is pointing at bug 447660 as the culprit, more specifically http://hg.mozilla.org/mozilla-central/rev/56d432ad6ed6. That nicely explains why this doesn't reproduce on release builds until Fx39 but does on Nightly in the Fx37 range.
Blocks: 447660
Flags: needinfo?(mats)
Attached file frame dump + stack
Uhm, some frames appear to be on two child lists.  This is bad obviously,
but fortunately it's a bit of a false alarm as it's a temporary situation
and nothing bad can happen in this case.
Flags: needinfo?(mats)
Attached patch fix, wdiffSplinter Review
The reason the frames appear on two lists is that nsAutoOOFFrameList
is still in scope and it is its dtor that removes the OOF list.
So we just need to wrap it in a scope to make sure that happens
before the VerifyOverflowSituation() call.
Assignee: nobody → mats
Attachment #8687562 - Flags: review?(roc)
Attached patch fixSplinter Review
Severity: critical → normal
Flags: needinfo?(mats) → in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/1ffc4b1f166c
https://hg.mozilla.org/mozilla-central/rev/029ab28c46cc
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla45
You need to log in before you can comment on or make changes to this bug.