325069 - Crash using ::before selector with display:-moz-box, display:table and more stuff [@ IncrementalReflow::AddCommand]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase which crashes upon load.
It seems a regression, doesn't crash in 2005-09-18 build, crashes in 2005-09-19 build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-09-18+06%3A00%3A00&maxdate=2005-09-19+09%3A00%3A00&cvsroot=%2Fcvsroot
Maybe fallout from bug 11011?

Talkback ID: TB14499665Z
It doesn't crash in my debug build, strange enough.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes on load)

Comment 2

[Martijn Wargers (dead)]

From Talkback ID:
IncrementalReflow::AddCommand  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 885]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6472]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6326]
HandlePLEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6344]
SHELL32.dll + 0x520c24 (0x778b0c24)

Comment 3

[Boris Zbarsky [:bzbarsky]]

So we crash because the float frame for the span has a dead mParent.  The issue, of course is that we lose the float from the frame tree.  Yay BuildFloatList!  ;)

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Hrm, this doesn't crash for me using a debug build from yesterday or so.  Do I have something in my tree that's fixing it, or was it fixed recently?

Comment 5

[Martijn Wargers (dead)]

I still crash with a 2006-02-10 04:17 trunk build, so I don't think it's fixed yet.

Comment 6

[Jesse Ruderman]

2006-04-08 mac trunk build: crashes
2006-04-10 mac trunk build: does not crash

-> FIXED by BuildFloatList removal.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using https://bugzilla.mozilla.org/attachment.cgi?id=209989&action=view as the testcase with trunk build of SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060410 SeaMonkey/1.5a.

No crash.