###!!! ASSERTION: aPrevFrame must be the last continuation in its chain!: '!aPrevFrame || !aPrevFrame->GetNextContinuation()', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 671 This assertion was added in bug 299065, but I haven't tested to find out whether this bug is a more recent regression.
Oh, great. A combination of multi-line generated content with "special" (block-inside-inline) frames. I'll see what I can do.
Created attachment 228042 [details] testcase #2 This testcase demonstrates that this is a real bug: The text "new" is inserted before "ore" (which is the second line of the ":before" text), instead of after it. Using this testcase it is possible to verify that the bug existed prior to the introduction of the assertion in bug 299065. The assertion just made it easier to find. Also, notice the similarity to bug 327532. I'm looking into nsCSSFrameConstructor::ContentInserted() for the best way to fix this. I hope to have a patch sometime soon.
Created attachment 228048 [details] [diff] [review] patch This seems like the simplest and safest way to fix it. Just make sure that we're inserting the new frame after the last continuation of the ":before" pseudo-element.
Checking in layout/base/nsCSSFrameConstructor.cpp; /cvsroot/mozilla/layout/base/nsCSSFrameConstructor.cpp,v <-- nsCSSFrameConstructor.cpp new revision: 1.1242; previous revision: 1.1241 done
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9alpha
I accidentally mentioned the number of this bug in the check-in for bug 347853.
Added reftest based on Uri's testcase (fails in 2006-07-01) and crashtest based on my testcase.
You need to log in before you can comment on or make changes to this bug.