368568 - Crash [@ nsSpaceManager::BandRect::IsOccupiedBy] with testcase, using moz-column-count, floats, first-line and generated content

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, this crashes current trunk builds on load.
It doesn't crash a 2006-12-07 build, but it does crash a 2006-12-08 build, so probably a regression from bug 300030 somehow.

Talkback ID: TB28820929Z
nsSpaceManager::BandRect::IsOccupiedBy  [mozilla\layout\generic\nsspacemanager.cpp, line 1464]
nsSpaceManager::RemoveTrailingRegions  [mozilla\layout\generic\nsspacemanager.cpp, line 908]
nsBlockFrame::CheckFloats  [mozilla\layout\generic\nsblockframe.cpp, line 6265]
nsBlockFrame::Reflow  [mozilla\layout\generic\nsblockframe.cpp, line 1023]

Comment 1

[-fullmetaljacket-]

yup it crashed

Talkback ID: TB28838382G
nsSpaceManager::BandRect::AddFrame  [mozilla\layout\generic\nsspacemanager.cpp, line 1487]
nsBoxLayout::`scalar deleting destructor'
nsBlockFrame::GetMinWidth  [mozilla\layout\generic\nsblockframe.cpp, line 628]
nsAreaFrame::AttributeChanged  [mozilla\layout\generic\nsareaframe.cpp, line 145]
nsPopupFrameList::nsPopupFrameList  [mozilla\layout\xul\base\src\nspopupsetframe.cpp, line 86]

Comment 2

[Jesse Ruderman]

Still crashes on trunk (Mac nightly).

Comment 3

[Mike Schroepfer]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a6pre) Gecko/20070618 Minefield/3.0a6pre

Still crashes

Comment 4

[Eli Friedman]

Doesn't crash on current trunk (apparently my printing hang fix did it, since it's triggering a warning from it.)

Still asserts like crazy though; probably a textframe issue.

Comment 5

[Jesse Ruderman]

No longer crashes for me, too.  The only assertion I see is "Invalid offset" (bug 385270).

Comment 6

[Jesse Ruderman]

WFM completely now.

Comment 7

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e1be6d19f8e2

Comment 8

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

https://hg.mozilla.org/mozilla-central/rev/e1be6d19f8e2