Created attachment 8793062 [details] testcase The attached testcase asserts on mozilla-central revision 62f79d676e0e Assertion failure: !nifNeedPushedItem || mDidPushItemsBitMayLie (NS_STATE_GRID_DID_PUSH_ITEMS lied), at src/layout/generic/nsGridContainerFrame.cpp:5474 Removing line 5 or 6 results in a similar assertion: Assertion failure: foundOwnPushedChild || !items.IsEmpty() || mDidPushItemsBitMayLie (NS_STATE_GRID_DID_PUSH_ITEMS lied), at /home/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:5661
Same underlying issue as bug 1278461?
For the moment, I can't reproduce the crash. I'll pull freshies from central and try again.
Sorry, pulling the 62f79d676e0e revision to test...
truber, I can't replicate this bug with revision 62f79d676e0e or with a more current mozilla-central. Do you have another testcase?
Flags: needinfo?(bwerth) → needinfo?(jschwartzentruber)
Still reproduces for me in m-c f0e6cc636021. Just tried debug and it is intermittent there (I'm using asan-debug usually). Changing the timeout makes it more reliable, I'll update it.
A pending fix for bug 1278461 also fixes this bug, which has a similar pathology. I rolled attachment 8793765 [details] into the crashtests in the patch on the other bug.
Resolving this as fixed by bug 1278461.
Assignee: nobody → bwerth
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → FIXED
Whiteboard: [fixed by bug 1278461]
status-firefox52: affected → fixed
Target Milestone: --- → mozilla52
You need to log in before you can comment on or make changes to this bug.