Closed
Bug 399676
Opened 17 years ago
Closed 17 years ago
[FIX]"ASSERTION: Float frame has wrong parent" with float in MathML
Categories
(Core :: MathML, defect, P3)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: bzbarsky)
References
Details
(Keywords: assertion, testcase)
Attachments
(2 files)
|
182 bytes,
application/xhtml+xml
|
Details | |
|
1.68 KB,
patch
|
roc
:
review+
roc
:
superreview+
|
Details | Diff | Splinter Review |
###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 745
|
||
Comment 1•17 years ago
|
||
No assert in a bit older build (Thu Oct 04 21:47:58 2007 -0500). Bug 397518 ?
|
Reporter | |
Comment 3•17 years ago
|
||
I think this can lead to MarkOutOfFlowFrameForDisplay dereferencing 0xddddde01.
Flags: blocking1.9?
|
||
Updated•17 years ago
|
Flags: blocking1.9? → blocking1.9+
Priority: -- → P3
|
|
Reporter | |
Updated•17 years ago
|
Priority: P3 → P2
Priority: P2 → P3
hwaara, maybe take a crack at this one?
|
||
Comment 5•17 years ago
|
||
OK, let's see if any this makes sense.
The testcase is basically:
<html>
<body>
<mtd><span style="float: left;"><span></mtd>
</body>
</html>
The interesting stuff starts in in nsCSSFrameConstructor::ConstructFrameByDisplayType() when we call ConstructBlock() to setup the floating <span> block frame. (http://lxr.mozilla.org/mozilla/source/layout/base/nsCSSFrameConstructor.cpp#6559)
1. The two important arguments here we pass to ConstructBlock() are aParentFrame and aContentParentFrame.
2. aContentParentFrame is our <mtd>.
3. aParentFrame however, is decided based on the geometric parent (aState.GetGeometricParent()), which in our case will be the mFloatedItems.containingBlock, which is the <body> at this point.
4. Eventually, InitAndRestoreFrame is called on the <span>, which is inited with the <body> as its parent frame.
5. The placeholder frame for the float gets the <mtd> as its parent.
6. Later when we're reflowing, the assertion is firing because the <mtd> block expects itself to be the floating <span>'s parent, but the floating span has the <body> as its parent.
In #3, should mFloatedItems.containingBlock have been the <mtd>? Should the placeholder frame and the span in reality have the same parent frame?
BTW, on several occasions when testing this, I also hit a possibly related assertion:
WARNING: nsBlockFrame::CheckFloats: Explicit float list is out of sync with float cache: file /Users/hakan/Programmering/mozilla/mozilla/layout/generic/nsBlockFrame.cpp, line 6688
The mtd is a table cell, so it should be the float's geometric parent. Somehow we're setting up the wrong geometric parent there.
|
Assignee | |
Comment 7•17 years ago
|
||
Assignee: rbs → bzbarsky
Status: NEW → ASSIGNED
Attachment #303111 -
Flags: superreview?(roc)
Attachment #303111 -
Flags: review?(roc)
|
|
Assignee | |
Updated•17 years ago
|
Summary: "ASSERTION: Float frame has wrong parent" with float in MathML → [FIX]"ASSERTION: Float frame has wrong parent" with float in MathML
Attachment #303111 -
Flags: superreview?(roc)
Attachment #303111 -
Flags: superreview+
Attachment #303111 -
Flags: review?(roc)
Attachment #303111 -
Flags: review+
|
|
Assignee | |
Comment 8•17 years ago
|
||
Fixed.
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•