Created attachment 251925 [details] testcase See testcase, which crashes in current Mozilla trunk build on load. Talkback ID: TB28472686W nsHTMLButtonControlFrame::GetContentInsertionFrame [mozilla\layout\forms\nshtmlbuttoncontrolframe.h, line 131] nsBlockFrame::RenumberListsInBlock [mozilla\layout\generic\nsblockframe.cpp, line 6095] nsBlockFrame::RenumberLists [mozilla\layout\generic\nsblockframe.cpp, line 6073] nsBlockFrame::Reflow [mozilla\layout\generic\nsblockframe.cpp, line 872] It doesn't crash a 2006-12-07 build, but it does crash a 2006-12-08 build, so I guess this is a regression somehow from the reflow branch landing.
I'm seeing the crash in nsColumnSetFrame::GetContentInsertionFrame (but stack below that matching).
So are column set frames allowed to not have a child? If so, GetContentInsertionFrame probably needs some work (not sure how, exactly). But the crash I'm seeing here is a null dereference in GetContentInsertionFrame for the outer span in the testcase. (That seems rather odd to me.)
It's always supposed to have a child.
WFM (Mac trunk nightly).
Testcase also wfm, using: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070423 Minefield/3.0a4pre
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ nsHTMLButtonControlFrame::GetContentInsertionFrame]
Flags: in-testsuite? → in-testsuite+
Assignee: nobody → martijn.martijn
You need to log in before you can comment on or make changes to this bug.