[FIX]"ASSERTION: Float frame has wrong parent" with float in MathML

RESOLVED FIXED

Status

()

defect
P3
normal
RESOLVED FIXED
12 years ago
12 years ago

People

(Reporter: jruderman, Assigned: bzbarsky)

Tracking

(Blocks 1 bug, {assertion, testcase})

Trunk
x86
All
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

Posted file testcase
###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 745
No assert in a bit older build (Thu Oct 04 21:47:58 2007 -0500). Bug 397518 ?
(reproducible on Linux as well as Mac)
OS: Mac OS X → All
I think this can lead to MarkOutOfFlowFrameForDisplay dereferencing 0xddddde01.
Flags: blocking1.9?
Flags: blocking1.9? → blocking1.9+
Priority: -- → P3
Priority: P3 → P2
hwaara, maybe take a crack at this one?
OK, let's see if any this makes sense.

The testcase is basically:

<html>
<body>
  <mtd><span style="float: left;"><span></mtd>
</body>
</html>

The interesting stuff starts in in nsCSSFrameConstructor::ConstructFrameByDisplayType() when we call ConstructBlock() to setup the floating <span> block frame. (http://lxr.mozilla.org/mozilla/source/layout/base/nsCSSFrameConstructor.cpp#6559)

1. The two important arguments here we pass to ConstructBlock() are aParentFrame and aContentParentFrame.
2. aContentParentFrame is our <mtd>.
3. aParentFrame however, is decided based on the geometric parent (aState.GetGeometricParent()), which in our case will be the mFloatedItems.containingBlock, which is the <body> at this point.
4. Eventually, InitAndRestoreFrame is called on the <span>, which is inited with the <body> as its parent frame.
5. The placeholder frame for the float gets the <mtd> as its parent.
6. Later when we're reflowing, the assertion is firing because the <mtd> block expects itself to be the floating <span>'s parent, but the floating span has the <body> as its parent.

In #3, should mFloatedItems.containingBlock have been the <mtd>? Should the placeholder frame and the span in reality have the same parent frame?

BTW, on several occasions when testing this, I also hit a possibly related assertion:

WARNING: nsBlockFrame::CheckFloats: Explicit float list is out of sync with float cache: file /Users/hakan/Programmering/mozilla/mozilla/layout/generic/nsBlockFrame.cpp, line 6688
The mtd is a table cell, so it should be the float's geometric parent. Somehow we're setting up the wrong geometric parent there.
Posted patch FixSplinter Review
Assignee: rbs → bzbarsky
Status: NEW → ASSIGNED
Attachment #303111 - Flags: superreview?(roc)
Attachment #303111 - Flags: review?(roc)
Summary: "ASSERTION: Float frame has wrong parent" with float in MathML → [FIX]"ASSERTION: Float frame has wrong parent" with float in MathML
Attachment #303111 - Flags: superreview?(roc)
Attachment #303111 - Flags: superreview+
Attachment #303111 - Flags: review?(roc)
Attachment #303111 - Flags: review+
Fixed.
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Crashtest checked in.
Flags: in-testsuite+
Blocks: 413185
Depends on: 419545
No longer depends on: 419545
You need to log in before you can comment on or make changes to this bug.