337476 - "ASSERTION: invalid previous frame", "ASSERTION: unexpected child frame type", frames dropped (testcase involves table-caption and XUL)

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect)

Description

[Jesse Ruderman]

The testcase produces two assertions when loaded: 

###!!! ASSERTION: invalid previous frame: '!aPrevFrame', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 246
###!!! ASSERTION: unexpected child frame type: 'PR_FALSE', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 228

With a patch for bug 334514, I also get a message that 23 frames got dropped on the floor when I reload or close the page.  Since other bugs involving dropped frames have been security holes (such as bug 268575), I'm marking this as security-sensitive for now even though I can't figure out how to make this one crash.  I'm curious why I can't get this one to crash.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Daniel Veditz [:dveditz]]

I don't get these assertions in ff2. I do get a single "waaah!" from nsXULPrototypeDocument.cpp, line 869

Comment 3

[Jesse Ruderman]

Bug 323493 involves some of the same assertions.

Comment 4

[Mats Palmgren (inactive)]

I think I have a fix for this, at least the fix I have for the crashes in
bug 341858 and bug 343270 also fixes the assertions here...

Comment 5

[Jesse Ruderman]

Bug 348126 might be a dup, and does have a crashing testcase.

Comment 6

[Bernd]

fixed by the checkin for bug bug 341858 

Comment 7

[Jesse Ruderman]

Crashtest checked in.