398510 - [FIX]Crash [@ IsPercentageAware] removing text from mtd with :first-letter

Status: RESOLVED FIXED

(Core :: MathML, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase triggers a crash [@ IsPercentageAware], with an assertion warning about the impending crash.

###!!! ASSERTION: null frame is not allowed: 'aFrame', file /Users/jruderman/trunk/mozilla/layout/generic/nsLineLayout.cpp, line 712

Comment 1

[Boris Zbarsky [:bzbarsky]]

We have a first-letter frame with no textframe inside.  Shouldn't really be happening...

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

The issue is that we assume first-letter only happens on float containing blocks, and MathML is violating this assumption.  Fix is to not allow first-letter on MathML cell inners.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Boris, this is probably fixed by my patch to wrap non-MathML children of MathML in blocks, do you want this patch in any case?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yes, I think we still need this patch.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed.  Need to land test once we sort out where...

Comment 6

[Boris Zbarsky [:bzbarsky]]

> +                         PR_TRUE, childItems, PR_FALSE);

This should have been:

+                         PR_TRUE, childItems, isBlock);

Regression tests caught it, yay.

Comment 7

[Jesse Ruderman]

Crashtest checked in.