372553 - [FIX]"ASSERTION: Some frame destructors were not called" with :first-letter, wrapping

Status: RESOLVED FIXED

(Core :: Layout, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase (reload to see the assertion)

The testcase triggers the following assertion when reloaded / closed:

###!!! ASSERTION: Some frame destructors were not called: 'mFrameCount == 0', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 644

This assertion often indicates the presence of a security hole, but I don't think that's true for this bug.

Also, the rendering is incorrect -- the lowercase 'b's are missing.

Comment 1

[Jesse Ruderman]

Attachment: reference rendering

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed fix

When we recover letter frames here, we put the letter frame as a child of the first in-flow of the first child of the block, since that's where the text is.

Then we pull that letter frame in nsInlineFrame::ReflowFrames and reflow it.  It creates a continuation, which is now in our child list.  But we don't ever reflow that, because we go ahead and pull the _next_ frame from the next-in-flow.  We need to notice when creating a continuation actually left the continuation in our list and deal with that case, which is what this patch does.

Comment 3

[Boris Zbarsky [:bzbarsky]]

And I don't think there's a security problem -- we only leak a text frame.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Fixed.  Still need to add a testcase...  Jesse, you have time to do that?

Comment 5

[Jesse Ruderman]

Sure.  The testcase and reference rendering here were intended as a reftest pair; should I check them in?

Comment 6

[Boris Zbarsky [:bzbarsky]]

That'd rock.

Comment 7

[Jesse Ruderman]

Reftest checked in.