Closed Bug 1517299 Opened 1 year ago Closed 1 year ago
Assertion failure: Is
In Uncomposed Doc() || Is In Shadow Tree() (This will end badly!), at /builds/worker/workspace/build/src/dom/base/ns IContent Inlines .h:29
Testcase found while fuzzing mozilla-central rev 5826b2352ac0. Assertion failure: IsInUncomposedDoc() || IsInShadowTree() (This will end badly!), at /builds/worker/workspace/build/src/dom/base/nsIContentInlines.h:29 Unfortunately we still don't have symbolized debug builds so no stacktrace is available.
Edgar, looks at your wheelhouse. Do you want to take a look?
The assertion hints about some issue in frame constructions. FWIW, I haven't managed to reproduce the issue, either with debug build or opt build + release assert. Jason, what kind of build is needed to trigger the issue?
It's column-span related, you need the column-span pref, which is off by default. If you see test-cases from fuzzing with column-span: all, send them my (or Ting-Yu's) way.
Component: Layout → Layout: Columns
Priority: -- → P3
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Duplicate of bug: 1520722
You need to log in before you can comment on or make changes to this bug.