179209 - CSS poups in tables nested in positioned div crashes Gecko [@ nsIFrame::GetStyleData ]

Status: RESOLVED FIXED

(Core :: Layout: Positioned, defect, P2)

Description

[Stefan Huszics]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0.0) Gecko/20020530
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.0.0) Gecko/20020530

Tested both with Mozilla 1.1 and (Phoenix) Gecko/20021108

Crashes as soon as you hover above a link that is not on the first line.

Reproducible: Always

Steps to Reproduce:
1. Check testcase

Comment 1

[Bernd]

TB13711228E filed.
first one assertions pops up:
WARNING: blowing an incremental reflow targeted at a nested inline, file c:/moz_
sour/mozilla/mozilla/layout/html/base/src/nsBlockFrame.cpp, line 1762
###!!! ASSERTION: frame was not removed from primary frame map before destructio
n or was readded to map after being removed: '!PL_DHASH_ENTRY_IS_BUSY(entry) ||
entry->frame != aFrame', file c:/moz_sour/mozilla/mozilla/layout/html/base/src/n
sFrameManager.cpp, line 1049
Break: at file c:/moz_sour/mozilla/mozilla/layout/html/base/src/nsFrameManager.c
pp, line 1049

and then it chrashes at

	aSID	eStyleStruct_Display
+	aStyleStruct	0x00000000
+	mStyleContext	0xdddddddd
+	this	0x00f0f5d4


nsIFrame::GetStyleData(nsStyleStructID eStyleStruct_Display, const nsStyleStruct
* & 0x00000000) line 578 + 16 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x00f0f6c0, unsigned int & 0,
nsHTMLReflowMetrics * 0x00000000, int & 0) line 1107
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03fb3280, const
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame *
0x00f0f6c0, unsigned int & 0) line 719 + 22 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03fb3280, const nsHTMLReflowState
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...},
unsigned int & 0) line 524 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x00eae864, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 433 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x00eae864, unsigned int & 0,
nsHTMLReflowMetrics * 0x00000000, int & 0) line 1047 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03fb3280, const
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame *
0x00eae864, unsigned int & 0) line 719 + 22 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03fb3280, const nsHTMLReflowState
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...},
unsigned int & 0) line 524 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x00eae82c, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 433 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x00eae82c, unsigned int & 0,
nsHTMLReflowMetrics * 0x00000000, int & 0) line 1047 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03fb3280, const
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame *
0x00eae82c, unsigned int & 0) line 719 + 22 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03fb3280, const nsHTMLReflowState
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...},
unsigned int & 0) line 524 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x00eb0698, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 433 + 28 bytes
nsPositionedInlineFrame::Reflow(nsPositionedInlineFrame * const 0x00eb0698,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 1296 + 25 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x00eb0698, unsigned int & 0,
nsHTMLReflowMetrics * 0x00000000, int & 0) line 1047 + 43 bytes
nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineLayout &
{...}, nsLineList_iterator {...}, nsIFrame * 0x00eb0698, unsigned char *
0x0091a394) line 3866 + 22 bytes
nsBlockFrame::DoReflowInlineFrames(nsBlockReflowState & {...}, nsLineLayout &
{...}, nsLineList_iterator {...}, int * 0x0091aad0, unsigned char * 0x0091a87c,
int 0, int 1) line 3733 + 32 bytes
nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState & {...},
nsLineList_iterator {...}, int * 0x0091aad0, unsigned char * 0x0091a87c, int 0,
int 1) line 3637 + 46 bytes
nsBlockFrame::ReflowInlineFrames(nsBlockReflowState & {...}, nsLineList_iterator
{...}, int * 0x0091aad0, int 1, int 0) line 3581 + 36 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...},
int * 0x0091aad0, int 1) line 2654 + 33 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2298 + 31 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x00f0eabc, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 942 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00f0eabc, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int
15, int 15, unsigned int 0, unsigned int & 0) line 927 + 31 bytes
nsTableCellFrame::Reflow(nsTableCellFrame * const 0x00f0ea5c, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 951
nsContainerFrame::ReflowChild(nsIFrame * 0x00f0ea5c, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int
30, int 0, unsigned int 0, unsigned int & 0) line 927 + 31 bytes
nsTableRowFrame::IR_TargetIsChild(nsTableRowFrame * const 0x00f0e8bc,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, nsTableFrame & {...}, unsigned int & 0, nsIFrame *
0x00f0ea5c) line 1318 + 45 bytes
nsTableRowFrame::IncrementalReflow(nsTableRowFrame * const 0x00f0e8bc,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, nsTableFrame & {...}, unsigned int & 0) line 1202 +
46 bytes
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x00f0e8bc, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 1472 + 35 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00f0e8bc, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0,
int 0, unsigned int 0, unsigned int & 0) line 927 + 31 bytes
nsTableRowGroupFrame::IR_TargetIsChild(nsTableRowGroupFrame * const 0x00f0e730,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, nsRowGroupReflowState
& {...}, unsigned int & 0, nsIFrame * 0x00f0e8bc) line 1744 + 45 bytes
nsTableRowGroupFrame::IncrementalReflow(nsTableRowGroupFrame * const 0x00f0e730,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, nsRowGroupReflowState
& {...}, unsigned int & 0) line 1413 + 42 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x00f0e730,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 1322 + 31 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00f0e730, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0,
int 30, unsigned int 0, unsigned int & 0) line 927 + 31 bytes
nsTableFrame::IR_TargetIsChild(nsTableFrame * const 0x00f0e578, nsIPresContext *
0x03fb3280, nsTableReflowState & {...}, unsigned int & 0, nsIFrame * 0x00f0e730)
line 3032 + 50 bytes
nsTableFrame::IncrementalReflow(nsTableFrame * const 0x00f0e578, nsIPresContext
* 0x03fb3280, const nsHTMLReflowState & {...}, unsigned int & 0) line 2760 + 38
bytes
nsTableFrame::Reflow(nsTableFrame * const 0x00f0e578, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 2020 + 27 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00f0e578, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0,
int 0, unsigned int 3, unsigned int & 0) line 927 + 31 bytes
nsTableOuterFrame::OuterReflowChild(nsTableOuterFrame * const 0x00f0e42c,
nsIPresContext * 0x03fb3280, nsIFrame * 0x00f0e578, const nsHTMLReflowState &
{...}, nsHTMLReflowMetrics & {...}, int 8700, nsSize & {...}, nsMargin & {...},
nsMargin & {...}, nsMargin & {...}, nsReflowReason eReflowReason_Incremental,
unsigned int & 0) line 1344 + 47 bytes
nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x00f0e42c,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 1709 + 71 bytes
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const
0x00f0e42c, nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 1469 + 31 bytes
nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x00f0e42c,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0, nsIFrame * 0x00f0e578) line 1441 +
31 bytes
nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x00f0e42c,
nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics & {...}, const
nsHTMLReflowState & {...}, unsigned int & 0) line 1421 + 42 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x00f0e42c, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 1951 + 31 bytes
nsBlockReflowContext::ReflowBlock(const nsRect & {...}, int 1,
nsCollapsingMargin & {...}, int 0, nsMargin & {...}, nsHTMLReflowState & {...},
unsigned int & 0) line 536 + 42 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineList_iterator
{...}, int * 0x0091c770) line 3337 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...},
int * 0x0091c770, int 1) line 2516 + 27 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2298 + 31 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x00f0e284, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 942 + 15 bytes
nsBlockReflowContext::ReflowBlock(const nsRect & {...}, int 0,
nsCollapsingMargin & {...}, int 1, nsMargin & {...}, nsHTMLReflowState & {...},
unsigned int & 0) line 536 + 42 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineList_iterator
{...}, int * 0x0091d2ec) line 3337 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...},
int * 0x0091d2ec, int 1) line 2516 + 27 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2298 + 31 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x00f0df78, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 942 + 15 bytes
nsBlockReflowContext::ReflowBlock(const nsRect & {...}, int 1,
nsCollapsingMargin & {...}, int 1, nsMargin & {...}, nsHTMLReflowState & {...},
unsigned int & 0) line 536 + 42 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineList_iterator
{...}, int * 0x0091de68) line 3337 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineList_iterator {...},
int * 0x0091de68, int 1) line 2516 + 27 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2298 + 31 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x00f0dd84, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 942 + 15 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00f0dd84, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0,
int 0, unsigned int 0, unsigned int & 0) line 927 + 31 bytes
CanvasFrame::Reflow(CanvasFrame * const 0x00ec17b4, nsIPresContext * 0x03fb3280,
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 567
nsBoxToBlockAdaptor::Reflow(nsBoxLayoutState & {...}, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0, int 0, int 0, int 8940, int 4470, int 1) line 925
nsBoxToBlockAdaptor::DoLayout(nsBoxToBlockAdaptor * const 0x00f0dce8,
nsBoxLayoutState & {...}) line 668 + 46 bytes
nsBox::Layout(nsBox * const 0x00f0dce8, nsBoxLayoutState & {...}) line 1066
nsScrollBoxFrame::DoLayout(nsScrollBoxFrame * const 0x00ec1bb0, nsBoxLayoutState
& {...}) line 361
nsBox::Layout(nsBox * const 0x00ec1bb0, nsBoxLayoutState & {...}) line 1066
nsContainerBox::LayoutChildAt(nsBoxLayoutState & {...}, nsIBox * 0x00ec1bb0,
const nsRect & {...}) line 647 + 16 bytes
nsGfxScrollFrameInner::LayoutBox(nsBoxLayoutState & {...}, nsIBox * 0x00ec1bb0,
const nsRect & {...}) line 1163 + 17 bytes
nsGfxScrollFrameInner::Layout(nsBoxLayoutState & {...}) line 1318
nsGfxScrollFrame::DoLayout(nsGfxScrollFrame * const 0x00ec1a8c, nsBoxLayoutState
& {...}) line 1171 + 15 bytes
nsBox::Layout(nsBox * const 0x00ec1a8c, nsBoxLayoutState & {...}) line 1066
nsBoxFrame::Reflow(nsBoxFrame * const 0x00ec1a54, nsIPresContext * 0x03fb3280,
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 900
nsGfxScrollFrame::Reflow(nsGfxScrollFrame * const 0x00ec1a54, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 847 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x00ec1a54, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, int 0,
int 0, unsigned int 0, unsigned int & 0) line 927 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x00ec16a8, nsIPresContext *
0x03fb3280, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...},
unsigned int & 0) line 579
IncrementalReflow::Dispatch(nsIPresContext * 0x03fb3280, nsHTMLReflowMetrics &
{...}, const nsSize & {...}, nsIRenderingContext & {...}) line 894
PresShell::ProcessReflowCommands(int 0) line 6512
PresShell::FlushPendingNotifications(PresShell * const 0x03fbc280, int 0) line 5203
nsEventStateManager::FlushPendingEvents(nsIPresContext * 0x03fb3280) line 4453
nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x03fb9888,
nsIPresContext * 0x03fb3280, nsEvent * 0x0091f7e4, nsIFrame * 0x00eae408,
nsEventStatus * 0x0091f5dc, nsIView * 0x040572d0) line 407
PresShell::HandleEventInternal(nsEvent * 0x0091f7e4, nsIView * 0x040572d0,
unsigned int 1, nsEventStatus * 0x0091f5dc) line 6238 + 43 bytes
PresShell::HandleEvent(PresShell * const 0x03fbc284, nsIView * 0x040572d0,
nsGUIEvent * 0x0091f7e4, nsEventStatus * 0x0091f5dc, int 0, int & 1) line 6167 +
25 bytes
nsViewManager::HandleEvent(nsView * 0x03fcc790, nsGUIEvent * 0x0091f7e4, int 0)
line 2209
nsView::HandleEvent(nsViewManager * 0x03fb2dc0, nsGUIEvent * 0x0091f7e4, int 0)
line 304
nsViewManager::DispatchEvent(nsViewManager * const 0x03fb2dc0, nsGUIEvent *
0x0091f7e4, nsEventStatus * 0x0091f6e0) line 1943 + 23 bytes
HandleEvent(nsGUIEvent * 0x0091f7e4) line 83
nsWindow::DispatchEvent(nsWindow * const 0x03fcc674, nsGUIEvent * 0x0091f7e4,
nsEventStatus & nsEventStatus_eIgnore) line 1069 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0091f7e4) line 1090
nsWindow::DispatchMouseEvent(unsigned int 300, unsigned int 0, nsPoint *
0x00000000) line 5282 + 21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 300, unsigned int 0, nsPoint *
0x00000000) line 5539
nsWindow::ProcessMessage(unsigned int 512, unsigned int 0, long 17694798, long *
0x0091fc48) line 4000 + 28 bytes
nsWindow::WindowProc(HWND__ * 0x00000a8c, unsigned int 512, unsigned int 0, long
17694798) line 1338 + 27 bytes
KERNEL32! bff7363b()
KERNEL32! bff94407()
00918cce()

Comment 2

[Bernd]

Chris,

could you please look at it, it involves frame constrcution inside a table and
chrashes reproducible + there is a nice testcase.

Comment 3

[Olivier Cahagne]

confirming using debug build 20021103 on Linux.

Comment 4

[Olivier Cahagne]

Attachment: Stack trace on Linux build 20021103

Comment 5

[Hixie (not reading bugmail)]

->tables

Comment 6

[Hixie (not reading bugmail)]

oops, only meant to reassign QA. ->karnaze as per previous comments

Comment 7

[Amarendra Hanumanula]

 Confirming the crash with trunk build: 2002-11-11-08 on WINXP.

Comment 8

[karnaze (gone)]

Attachment: patch to fix the bug

Comment 9

[karnaze (gone)]

Attachment: somewhat reduced test case

Comment 10

[karnaze (gone)]

Comment on attachment 106062 [details]
somewhat reduced test case  

To see the bug, make the window narrrow enough so that PutTheCursorOverThisText
is on it own line.

Comment 11

[Boris Zbarsky [:bzbarsky]]

What happens in paginated mode?  That is, why is this fix only for galley mode?
 Is it because in "initial" frame construction we do this right and there are no
dynamic effects happening in paginated mode?

Or, more precisely, what would break if this patch were applied to both modes?

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Ian, do you have testcases for absolutely positioned elements within relatively
positioned inlines?  I know Troy spent a good bit of time working on that code,
and it seems that this patch might cause a pretty significant change in behavior.

Chris, any idea what was causing the frame to be readded to the primary frame
map during its destruction?  (Or does that assertion still happen?)

Comment 13

[Boris Zbarsky [:bzbarsky]]

Troy never really solved the basic problem inherent in positioned inlines... see
the comment at
http://lxr.mozilla.org/seamonkey/source/layout/html/base/src/nsHTMLReflowState.cpp#1552
(nsHTMLReflowState::ComputeContainingBlockRectangle).  Given that, I almost
suspect that this patch will do nothing to affect our (really broken) rendering.

The assertion does still happen.  Having played with the testcase a bit, if I
eliminate the ".pop a span {display:none;}" rule, I _still_ crash when I hover
over the link.  Bug if I then take the ":hover" out of ".pop a:hover span
{position:absolute;}" I no longer crash (on load or on hover)....

Removing the table from around all that stuff also makes me no longer crash (on
load or on hover).

Comment 14

[Hixie (not reading bugmail)]

dbaron: No, I don't. I'll see if I can make some.

Comment 15

[karnaze (gone)]

(re comment #11) 
I was afraid to apply the same logic to printing, because I think it would break
the (yet to be reviewed and landed) patch in bug 154892 (splitting absolutely
positioned elements) where next-in-flow absolute containers may keep track of
their own positioned children. I'll put a comment in that bug as a reminder to
try to develop a test case that causes a similar problem as here. 

(re comment #12) 
I'm not exactly sure what was causing the "frame map" assertion, but it happened
during reflow when the relative positioned inline's first-in-flow completed and
its next-in-flow got destroyed in DeleteNexInFlowChild. The next-in-flow
contained the absolute span. I thought this was incorrect, since we had no code
to recover that absolute span and all of the situations (which we either now
support or not) could be accomplished (and simplified) by only placing absolute
children in the first-in-flow.  

With the patch, I'm no longer failing on the "frame map" assertion but do still
continue to fail on the following (which doesn't appear to cause any problems
later). 

  NS_PRECONDITION(containingBlockHeight != NS_AUTOHEIGHT,
                  "containing block height must be constrained");

(re commment #13) 
With the patch, I can't get attachment 106062 [details] to crash when removing the ".pop a
span {display:none;}" rule or otherwise.

Boris, are you still getting the "frame map" assertion and a crash with the
patch and attachment 106062 [details]? If so, can you please be more specific on how to
reproduce?

Comment 16

[karnaze (gone)]

Attachment: revised patch to potentially fix more cases

I'm not sure if PushAbsoluteContainingBlock() could ever be called with a
next-in-flow, but this patch handles those cases.

Comment 17

[Boris Zbarsky [:bzbarsky]]

Oh.  I misread David's question...  With the patch, the assertion does not
happen.  The other assertion Chris is seeing is due to the containing block
issue I linked to and is a long-standing problem.

Comment 18

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 106089 [details] [diff] [review]
revised patch to potentially fix more cases 

> +      containingBlock = ((nsPositionedInlineFrame*)containingBlock)->GetFirstInFlow();

GetFirstInFlow() should just live on nsIFrame, imo... I've filed bug 187117 on
that.

> +    nsCOMPtr<nsIAtom> fType;

Any reason not to name that "frameType"?

I'm not sure I like the name "AdjustAbsoluteContainingBlock" but I can't think
of a better name. :(

The rest looks fine to me...

Comment 19

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 106089 [details] [diff] [review]
revised patch to potentially fix more cases 

r=dbaron

Comment 20

[karnaze (gone)]

fixed on trunk.

Comment 21

[Boris Zbarsky [:bzbarsky]]

Actually, now that GetFirstInFlow is on nsIFrame you don't need that case...
r/sr=bzbarsky for getting rid of it.

Comment 22

[karnaze (gone)]

Boris, are you saying to back out the entire patch or part of it? The only build
I have without the patch is 1/9 and the url (not the test case) crashes on that.

Comment 23

[Boris Zbarsky [:bzbarsky]]

All I'm saying is to change the line 

 containingBlock = ((nsPositionedInlineFrame*)containingBlock)->GetFirstInFlow();

to

 containingBlock = containingBlock->GetFirstInFlow();

My apologies for being unclear (and mis-spelling "cast").