368752 - Crash [@ nsIFrame::Invalidate] with display: inherit, large margin and padding and generated content

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk Mozilla builds (almost) on load.
This regressed between 2006-12-07 and 2006-12-08, so a regression from bug 300030.

Talkback ID: TB28865707Q
nsIFrame::Invalidate  [mozilla\layout\generic\nsframe.cpp, line 3690]
nsFrameManager::RemoveFrame  [mozilla\layout\base\nsframemanager.cpp, line 709]
DeletingFrameSubtree  [mozilla\layout\base\nscssframeconstructor.cpp, line 9399]
nsCSSFrameConstructor::ContentRemoved  [mozilla\layout\base\nscssframeconstructor.cpp, line 9549]
0x0144b158
0x85042444

Comment 1

[Martijn Wargers (dead)]

I don't seem to crash anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070512 Minefield/3.0a5pre

However, the word "text" doesn't show up anymore with the testcase. I guess this bug should be closed and a new bug should be filed for that?

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

yes, thanks.

Comment 3

[Martijn Wargers (dead)]

Ok, I filed bug 383854 for it.
This bug is worksforme.
Sorry for the delay. 

Comment 4

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/27604afdef11

Comment 5

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/27604afdef11