389630 - Crash [@ nsInlineFrame::PullOneFrame] with direction:rtl, :first-letter, wrapping

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase triggers two assertions and a crash:

###!!! ASSERTION: unexpected flow: 'mFrames.ContainsFrame(nextInFlow)', file mozilla/layout/generic/nsInlineFrame.cpp, line 462

###!!! ASSERTION: failed to remove frame: 'result', file mozilla/layout/generic/nsContainerFrame.cpp, line 830

Crash [@ nsInlineFrame::PullOneFrame] dereferencing 0xdddddddd or another address.

I think it's crashing at this line:
  702       mFrames.InsertFrame(this, irs.mPrevFrame, frame);
but gdb gets more confused than Mac OS X Crash Reporter :(

Comment 1

[Jesse Ruderman]

WFM on trunk.

Comment 2

[Jesse Ruderman]

FIXED by the patch in bug 382422.  (By-hand "reverting" of the patch for bug 382422 restored the crash [@ nsInlineFrame::PullOneFrame].)

FWIW, the assertions weren't exactly the same as when I first reported this bug.  Here's what I saw:

###!!! ASSERTION: unexpected flow: 'mFrames.ContainsFrame(nextInFlow)', file /Users/jruderman/trunk/mozilla/layout/generic/nsInlineFrame.cpp, line 462

###!!! ASSERTION: StealFrame failure: 'NS_SUCCEEDED(rv)', file /Users/jruderman/trunk/mozilla/layout/generic/nsContainerFrame.cpp, line 1026

Comment 3

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b3pre) Gecko/2008011009 Firefox/3.0b3pre ID:2008011009

Comment 4

[Jesse Ruderman]

This bug doesn't seem to affect branch.

Comment 5

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).