Crash [@ nsHTMLButtonControlFrame::GetContentInsertionFrame] with -moz-column-count and display: list-item

RESOLVED WORKSFORME

Status

()

Core
Layout
--
critical
RESOLVED WORKSFORME
12 years ago
5 years ago

People

(Reporter: Martijn Wargers (zombie), Assigned: Martijn Wargers (zombie))

Tracking

({crash, regression, testcase})

Trunk
x86
Windows XP
crash, regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Assignee)

Description

12 years ago
Created attachment 251925 [details]
testcase

See testcase, which crashes in current Mozilla trunk build on load.
Talkback ID: TB28472686W
nsHTMLButtonControlFrame::GetContentInsertionFrame  [mozilla\layout\forms\nshtmlbuttoncontrolframe.h, line 131]
nsBlockFrame::RenumberListsInBlock  [mozilla\layout\generic\nsblockframe.cpp, line 6095]
nsBlockFrame::RenumberLists  [mozilla\layout\generic\nsblockframe.cpp, line 6073]
nsBlockFrame::Reflow  [mozilla\layout\generic\nsblockframe.cpp, line 872]

It doesn't crash a 2006-12-07 build, but it does crash a 2006-12-08 build, so I guess this is a regression somehow from the reflow branch landing.
I'm seeing the crash in nsColumnSetFrame::GetContentInsertionFrame (but stack below that matching).
So are column set frames allowed to not have a child?  If so, GetContentInsertionFrame probably needs some work (not sure how, exactly).  But the crash I'm seeing here is a null dereference in GetContentInsertionFrame for the outer span in the testcase.  (That seems rather odd to me.)
It's always supposed to have a child.

Comment 4

11 years ago
WFM (Mac trunk nightly).
(Assignee)

Comment 5

11 years ago
Testcase also wfm, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070423 Minefield/3.0a4pre
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → WORKSFORME

Updated

11 years ago
Flags: in-testsuite?
Crash Signature: [@ nsHTMLButtonControlFrame::GetContentInsertionFrame]
Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b83cbc51f7f3
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.