343540 - "ASSERTION: aPrevFrame must be the last continuation in its chain!" involving <dd>

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

###!!! ASSERTION: aPrevFrame must be the last continuation in its chain!: '!aPrevFrame || !aPrevFrame->GetNextContinuation()', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 671

This assertion was added in bug 299065, but I haven't tested to find out whether this bug is a more recent regression.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Uri Bernstein]

Oh, great. A combination of multi-line generated content with "special" (block-inside-inline) frames. I'll see what I can do. 

Comment 3

[Uri Bernstein]

Attachment: testcase #2

This testcase demonstrates that this is a real bug: The text "new" is inserted before "ore" (which is the second line of the ":before" text), instead of after it.
Using this testcase it is possible to verify that the bug existed prior to the introduction of the assertion in bug 299065. The assertion just made it easier to find.
Also, notice the similarity to bug 327532.

I'm looking into nsCSSFrameConstructor::ContentInserted() for the best way to fix this. I hope to have a patch sometime soon.

Comment 4

[Uri Bernstein]

Attachment: patch

This seems like the simplest and safest way to fix it.
Just make sure that we're inserting the new frame after the last continuation of the ":before" pseudo-element.

Comment 5

[Uri Bernstein]

Checking in layout/base/nsCSSFrameConstructor.cpp;
/cvsroot/mozilla/layout/base/nsCSSFrameConstructor.cpp,v  <--  nsCSSFrameConstructor.cpp
new revision: 1.1242; previous revision: 1.1241
done

Comment 6

[Uri Bernstein]

I accidentally mentioned the number of this bug in the check-in for bug 347853.

Comment 7

[Jesse Ruderman]

Added reftest based on Uri's testcase (fails in 2006-07-01) and crashtest based on my testcase.