Closed Bug 325069 Opened 14 years ago Closed 14 years ago

Crash using ::before selector with display:-moz-box, display:table and more stuff [@ IncrementalReflow::AddCommand]

Categories

(Core :: Layout, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

See upcoming testcase which crashes upon load.
It seems a regression, doesn't crash in 2005-09-18 build, crashes in 2005-09-19 build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-09-18+06%3A00%3A00&maxdate=2005-09-19+09%3A00%3A00&cvsroot=%2Fcvsroot
Maybe fallout from bug 11011?

Talkback ID: TB14499665Z
It doesn't crash in my debug build, strange enough.
From Talkback ID:
IncrementalReflow::AddCommand  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 885]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6472]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6326]
HandlePLEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6344]
SHELL32.dll + 0x520c24 (0x778b0c24)
Summary: Crash using ::before selector with display:-moz-box, display:table and more stuff → Crash using ::before selector with display:-moz-box, display:table and more stuff [@ IncrementalReflow::AddCommand]
So we crash because the float frame for the span has a dead mParent.  The issue, of course is that we lose the float from the frame tree.  Yay BuildFloatList!  ;)
Depends on: 282173
Hrm, this doesn't crash for me using a debug build from yesterday or so.  Do I have something in my tree that's fixing it, or was it fixed recently?
I still crash with a 2006-02-10 04:17 trunk build, so I don't think it's fixed yet.
2006-04-08 mac trunk build: crashes
2006-04-10 mac trunk build: does not crash

-> FIXED by BuildFloatList removal.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Verified FIXED using https://bugzilla.mozilla.org/attachment.cgi?id=209989&action=view as the testcase with trunk build of SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060410 SeaMonkey/1.5a.

No crash.
Status: RESOLVED → VERIFIED
Crash Signature: [@ IncrementalReflow::AddCommand]
You need to log in before you can comment on or make changes to this bug.