370884 - "ASSERTION: aFrame shouldn't be in reflow; we'll lie if it is" involving position:fixed within <math:mroot>

Status: RESOLVED WORKSFORME

(Core :: MathML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: aFrame shouldn't be in reflow; we'll lie if it is: '!(aFrame->GetStateBits() & NS_FRAME_IN_REFLOW)', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 592

Comment 1

[Boris Zbarsky [:bzbarsky]]

Should retest once bug 366012 is fixed.

Comment 2

[Jesse Ruderman]

Still happens even though bug 366012 is fixed.

Comment 3

[Boris Zbarsky [:bzbarsky]]

I see:

WARNING: invalid markup: file ../../../../../mozilla/layout/mathml/base/src/nsMathMLmrootFrame.cpp, line 211
WARNING: GetBoundingMetrics failed: file ../../../../../mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp, line 105
WARNING: invalid markup: file ../../../../../mozilla/layout/mathml/base/src/nsMathMLmrootFrame.cpp, line 211
WARNING: GetBoundingMetrics failed: file ../../../../../mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp, line 105

which means we bail out of nsMathMLmrootFrame::Reflow after calling Reflow() on the kids but before calling FinishReflowChild().  That's violating the reflow contract; the assertion is just catching it.  I seem to recall another bug covering this sort of thing...

Comment 4

[Jesse Ruderman]

I still see the assertion on trunk.

Comment 5

[Jesse Ruderman]

WFM on trunk.

Comment 6

[Jesse Ruderman]

Crashtest: http://hg.mozilla.org/mozilla-central/rev/b64a7e4a35e2