1473612 - Assertion failure: !aFloat->GetNextInFlow(), at /builds/worker/workspace/build/src/layout/generic/BlockReflowInput.cpp:1014

Status: NEW

(Core :: Layout: Block and Inline, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev cc3401e78e8b.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007ffc6a736100
rsi = 0x00007fe73e1df8b0   rdi = 0x00007fe73e1de680
rbp = 0x00007ffc6a735590   rsp = 0x00007ffc6a735360
r8 = 0x00007fe73e1df8b0    r9 = 0x00007fe73f359740
r10 = 0x00000000ffffffc6   r11 = 0x0000000000000000
r12 = 0x00007ffc6a7354f0   r13 = 0x0000000000000206
r14 = 0x00007ffc6a735a0d   r15 = 0x00007fe71c607268
rip = 0x00007fe72eb89732
OS|Linux|0.0.0 Linux 4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:16:15 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|789|0x18
0|1|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|627|0xb
0|2|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.h:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|182|0x8
0|3|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|4158|0x14
0|4|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3958|0x29
0|5|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3835|0x41
0|6|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2816|0x1a
0|7|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2637|0x20
0|8|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1225|0xf
0|9|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|306|0x10
0|10|libxul.so|nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|6338|0x2d
0|11|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|917|0x9
0|12|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|627|0xb
0|13|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.h:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|182|0x8
0|14|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|4158|0x14
0|15|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3958|0x29
0|16|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3835|0x41
0|17|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2816|0x1a
0|18|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2352|0x20
0|19|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1225|0xf
0|20|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|951|0x1a
0|21|libxul.so|nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool, nsCollapsingMargin*, nsColumnSetFrame::ColumnBalanceData&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|767|0x48
0|22|libxul.so|nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig&, bool, nsCollapsingMargin*, nsColumnSetFrame::ColumnBalanceData&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|465|0x8
0|23|libxul.so|nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1201|0x10
0|24|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|306|0x10
0|25|libxul.so|nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|6338|0x2d
0|26|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|917|0x9
0|27|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|627|0xb
0|28|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.h:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|182|0x8
0|29|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|4158|0x14
0|30|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3958|0x29
0|31|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3835|0x41
0|32|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2816|0x1a
0|33|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2352|0x20
0|34|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1225|0xf
0|35|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|951|0x1a
0|36|libxul.so|nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsHTMLButtonControlFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|254|0x5
0|37|libxul.so|nsHTMLButtonControlFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsHTMLButtonControlFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|205|0x18
0|38|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|306|0x10
0|39|libxul.so|nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|6338|0x2d
0|40|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|917|0x9
0|41|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|627|0xb
0|42|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.h:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|182|0x8
0|43|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|4158|0x14
0|44|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3958|0x29
0|45|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3835|0x41
0|46|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2816|0x1a
0|47|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2352|0x20
0|48|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1225|0xf
0|49|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|951|0x1a
0|50|libxul.so|nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool, nsCollapsingMargin*, nsColumnSetFrame::ColumnBalanceData&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|767|0x48
0|51|libxul.so|nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig&, bool, nsCollapsingMargin*, nsColumnSetFrame::ColumnBalanceData&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|465|0x8
0|52|libxul.so|nsColumnSetFrame::FindBestBalanceBSize(mozilla::ReflowInput const&, nsPresContext*, nsColumnSetFrame::ReflowConfig&, nsColumnSetFrame::ColumnBalanceData&, mozilla::ReflowOutput&, nsCollapsingMargin&, bool&, bool&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1103|0x1e
0|53|libxul.so|nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1211|0x33
0|54|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|306|0x10
0|55|libxul.so|nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|6338|0x2d
0|56|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|917|0x9
0|57|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|627|0xb
0|58|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.h:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|182|0x8
0|59|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|4158|0x14
0|60|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3958|0x29
0|61|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3835|0x41
0|62|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2816|0x1a
0|63|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2352|0x20
0|64|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1225|0xf
0|65|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|306|0x10
0|66|libxul.so|nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|6338|0x2d
0|67|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|917|0x9
0|68|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|627|0xb
0|69|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.h:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|182|0x8
0|70|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|4158|0x14
0|71|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3958|0x29
0|72|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|3835|0x41
0|73|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2816|0x1a
0|74|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|2352|0x20
0|75|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:cc3401e78e8bbae22e6dbc854e525ceae4923bcf|1225|0xf

Comment 1

[Xidorn Quan [:xidorn] UTC+11]

A fully reflowed float has next-in-flow? Sounds weird...

Comment 2

[Tyson Smith [:tsmith]]

Attachment: testcase.html