394237 - "ASSERTION: Creating a circular frame list" with -moz-column and height

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

###!!! ASSERTION: overflow containers out of order or bad parent: '!(aOverflowCont->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER)', file /Users/jruderman/trunk/mozilla/layout/generic/nsContainerFrame.cpp, line 1331

###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aNextSibling', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsIFrame.h, line 800

Might be related to bug 393956.  Both testcases involve -moz-column and height, and both are derived from bug 379349 reftest files.

Filing as security-sensitive because before I reduced the testcase, I was getting crashes [@ nsIFrame::GetNextSibling] dereferencing 0x80f00023.

Comment 1

[fantasai]

Jesse, did you forget to attach the testcase here?

Comment 2

[Jesse Ruderman]

Attachment: testcase

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This is really bad.

Comment 4

[fantasai]

I have a fix for this in my tree. It'll be submitted as part of 154892, since the dynamic reftest I wrote for it crashes without this fix.

Comment 5

[Jesse Ruderman]

Yay!  Does your patch happen to fix other -moz-column memory safety bugs as well?  (e.g. bug 393956, bug 395316, bug 397007)

Comment 6

[fantasai]

Don't know. I'll check once I get my reftest to not crash. :P

Comment 7

[Jesse Ruderman]

Fantasai's patch in bug 154892 comment 212 fixes this bug for me.  It doesn't fix the other bugs I mentioned in comment 5, though.

Comment 8

[Carsten Book [:Tomcat]]

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9b3pre) Gecko/2008011009 Firefox/3.0b3pre ID:2008011009

Comment 9

[Jesse Ruderman]

This bug does not seem to affect branch.

Comment 10

[Jesse Ruderman]

Crashtest checked in.