Created attachment 260329 [details] testcase (reload to see the assertion) [sg:critical] because a slightly modified version of the testcase makes Firefox crash dereferencing a deleted object.
Created attachment 261347 [details] [diff] [review] fix This fixes it. We weren't processing pseudoframes in CreateListBoxContent so the anonymous table frame created for the table cell wasn't being moved into frameItems; it and its descendants were just lost.
Comment on attachment 261347 [details] [diff] [review] fix r+sr=bzbarsky
The testcase with the modification in comment 1 crashes a 220.127.116.11pre debug build because the nsStyleContext is 0xdddddddd (deleted). Never saw the described assertions but those may have been added on trunk. The patch in this bug makes it stop.
Yeah, those assertiosn are trunk-only.
10 years ago
Comment on attachment 261347 [details] [diff] [review] fix approved for 18.104.22.168 and 22.214.171.124, a=dveditz for release-drivers
fixed on branches.
verified fix on branch. Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Reloading the testcase for this bug triggers a "No common ancestor at all???" assertion. I filed bug 383806 for that.
Crashtest checked in.