Closed Bug 327187 Opened 14 years ago Closed 14 years ago

Crash on reload with evil xul testcase, using display:table on window and float:right

Categories

(Core :: Layout, defect, critical)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, regression, testcase)

Attachments

(2 files)

Keywords: regression
Attached file backtrace
Backtrace from debug build (I finally managed to get a working build again).

First, an assertion:
#1  0x6ff445a3 in Break(char const*) (
    aMsg=0x22dec8 "###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFl
ow', file c:/mozilla/mozilla/layout/generic/nsPlaceholderFrame.h, line 121")
    at c:/mozilla/mozilla/xpcom/base/nsDebugImpl.cpp:434
#2  0x6ff44300 in NS_DebugBreak_P (aSeverity=1,
    aStr=0x503ffc0 "Null out-of-flow for placeholder?",
    aExpr=0x503ffa5 "outOfFlow",
    aFile=0x503ff00 "c:/mozilla/mozilla/layout/generic/nsPlaceholderFrame.h",
    aLine=121) at c:/mozilla/mozilla/xpcom/base/nsDebugImpl.cpp:351
#3  0x057216e7 in nsPlaceholderFrame::GetRealFrameForPlaceholder(nsIFrame*) (
    aFrame=0x1049f060)
    at c:/mozilla/mozilla/layout/generic/nsPlaceholderFrame.h:121

Then the crash itself:
Program received signal SIGSEGV, Segmentation fault.
0x057bfb81 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574
574         NS_ASSERTION(mStyleContext, "No style context found!");
Current language:  auto; currently c++
(gdb) bt
#0  0x057bfb81 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574
#1  0x057bfdad in nsIFrame::GetStyleDisplay() const (this=0x0)
    at c:/mozilla/mozilla/layout/style/nsStyleStructList.h:90
#2  0x050370c7 in DoDeletingFrameSubtree(nsPresContext*, nsFrameManager*, nsVoid
Array&, nsIFrame*, nsIFrame*) (aPresContext=0x1005de68,
    aFrameManager=0x103f91cc, aDestroyQueue=@0x22e388,
    aRemovedFrame=0x1049ee84, aFrame=0x1049ee84)
    at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:9842
#3  0x05037352 in DeletingFrameSubtree(nsPresContext*, nsFrameManager*, nsIFrame
*) (aPresContext=0x1005de68, aFrameManager=0x103f91cc, aFrame=0x1049ee84)
    at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:9897
Fixing bug 282173 will fix this.
Depends on: 282173
WFM on Mac and Windows, using builds from before BuildFloatList removal but not more than two weeks old.

Martijn, do you still see this crash?
(In reply to comment #4)
> Martijn, do you still see this crash?

No, tested with 2006-04-10 build, so marking wfm.

Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.