358729 - "ASSERTION: Some frame destructors were not called" with tables, block-in-inline, rtl

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

I got some sg:critical looking crashes while reducing this, but I wasn't able to get it crashing again once I had a reduced testcase.  Because of the crashes with intermediate testcases, and because most bugs that trigger "ASSERTION: Some frame destructors were not called" can be used to cause exploitable crashes, I'm making this security-sensitive.

Comment 1

[Jesse Ruderman]

Attachment: testcase (close tab or reload to see the assertion)

Comment 2

[Boris Zbarsky [:bzbarsky]]

So I dunno what's going on here, but if I uncomment the code at http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsCSSFrameConstructor.cpp&rev=1.1278&mark=12936#12929 the assertion goes away.  It also goes away on the reflow branch.

I wonder whether this warning in non-reflow-branch builds:

  WARNING: blowing an incremental reflow targeted at a nested inline: file
  ../../../mozilla/layout/generic/nsBlockFrame.cpp, line 1735

is relevant...

Comment 3

[Jesse Ruderman]

I can't test whether the reflow branch landing fixed this bug until bug 363149 is fixed.

Comment 4

[Jesse Ruderman]

WFM with Mac trunk.  Probably fixed by the reflow branch landing.

Comment 5

[Samuel Sidler (old account; do not CC)]

Sorry, I meant to add this:

Jess told me that I needed to apply the patch in bug 334514 to test whether this assertion existed on the branch. I did so on the 1.8 branch and did not see the assertion in my build.

Comment 6

[chris hofmann]

sounds like this one is ready to close. right?

Comment 7

[Jesse Ruderman]

Yeah, WFM based on comment 4 and comment 5.

Comment 8

[Jesse Ruderman]

Crashtest checked in.

Comment 9

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).