"ASSERTION: next in flow should have been deleted" with -moz-column, overflowing height

RESOLVED FIXED

Status

()

defect
P3
normal
RESOLVED FIXED
12 years ago
12 years ago

People

(Reporter: jruderman, Assigned: fantasai.bugs)

Tracking

({assertion, testcase})

Trunk
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9 +
wanted1.8.1.x -
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [dbaron-1.9:RsCo])

Attachments

(2 attachments)

Posted file testcase
Loading the testcase triggers:

###!!! ASSERTION: next in flow should have been deleted: '!kidNextInFlow', file /Users/jruderman/trunk/mozilla/layout/generic/nsColumnSetFrame.cpp, line 549

Reloading it triggers:

###!!! ASSERTION: Some objects allocated with AllocateFrame were not freed: 'mFrameCount == 0', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 673
Flags: blocking1.9?
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /home/fantasai/moz/mozilla/layout/generic/nsBlockFrame.cpp, line 3056
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /home/fantasai/moz/mozilla/layout/generic/nsBlockFrame.cpp, line 1855
###!!! ASSERTION: reflow dirty lines failed: 'NS_SUCCEEDED(rv)', file /home/fantasai/moz/mozilla/layout/generic/nsBlockFrame.cpp, line 941
###!!! ASSERTION: next in flow should have been deleted: '!kidNextInFlow', file /home/fantasai/moz/mozilla/layout/generic/nsColumnSetFrame.cpp, line 549
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /home/fantasai/moz/mozilla/layout/generic/nsBlockFrame.cpp, line 3056
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x8000FFFF: file /home/fantasai/moz/mozilla/layout/generic/nsBlockFrame.cpp, line 1855
###!!! ASSERTION: reflow dirty lines failed: 'NS_SUCCEEDED(rv)', file /home/fantasai/moz/mozilla/layout/generic/nsBlockFrame.cpp, line 941
###!!! ASSERTION: next in flow should have been deleted: '!kidNextInFlow', file /home/fantasai/moz/mozilla/layout/generic/nsColumnSetFrame.cpp, line 549

ReflowChild doesn't delete the next-in-flows if it gets a failure from Reflow. (Also nsColumnSetFrame::ReflowChildren isn't checking the nsresult returned by ReflowChild.)

roc, should ReflowChild be deleting the orphaned nifs?
Probably, although I'm not really sure what the invariants surrounding failed Reflow are.

But Reflow really shouldn't be failing in the first place...
Flags: blocking1.9? → blocking1.9+
Yeah, that, too. This seems to fix that problem. Was getting some really *weird* frame trees when the balancing code tried to balance with the overflow containers.
Assignee: nobody → fantasai.bugs
Status: NEW → ASSIGNED
Attachment #285195 - Flags: superreview?(roc)
Attachment #285195 - Flags: review?(roc)
Whiteboard: [dbaron-1.9:RsCo]
Attachment #285195 - Flags: superreview?(roc)
Attachment #285195 - Flags: superreview+
Attachment #285195 - Flags: review?(roc)
Attachment #285195 - Flags: review+
Blocks: 400232
Attachment #285195 - Flags: approval1.9?
Comment on attachment 285195 [details] [diff] [review]
patch to fix layout

a=drivers for after M9 freeze
Attachment #285195 - Flags: approval1.9? → approval1.9+
fantasai said she can check-in herself.
Keywords: checkin-needed
Fix checked in: nsColumnSetFrame.cpp rev 3.44
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
Depends on: 408737
Depends on: 404215
The testcase doesn't trigger any assertions on branch.
Group: security
Flags: wanted1.8.1.x-
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.