349095 - Content doubling, "ASSERTION: DeletingFrameSubtree on a special frame" and "ASSERTION: no common ancestor at all???" with first-letter, block-in-inline

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

This testcase triggers:

###!!! ASSERTION: DeletingFrameSubtree on a special frame.  Prepare to crash.: '!IsFrameSpecial(aFrame)', file /Users/admin/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9833

###!!! ASSERTION: no common ancestor at all???: 'parent', file /Users/admin/trunk/mozilla/layout/base/nsLayoutUtils.cpp, line 344

This is likely to be a dup of bug 342120, but it involves an additional assertion, so I'm filing this bug to be sure.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

This is fixed for me between a 2006-11-02 build and a 2006-11-04 build.
I think this was fixed by the fix for bug 318592. It also seems fixed on branch.
So, I'm marking this fixed, please reopen if this still can be seen.

Comment 3

[Jesse Ruderman]

Verified (I no longer see the assertion with this testcase).

Comment 4

[Jesse Ruderman]

Crashtest checked in.  I guess a reftest would have been better (since there was content doubling), but I think the reftest for bug 318592 has that covered.