###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 745
No assert in a bit older build (Thu Oct 04 21:47:58 2007 -0500). Bug 397518 ?
(reproducible on Linux as well as Mac)
OS: Mac OS X → All
I think this can lead to MarkOutOfFlowFrameForDisplay dereferencing 0xddddde01.
hwaara, maybe take a crack at this one?
OK, let's see if any this makes sense. The testcase is basically: <html> <body> <mtd><span style="float: left;"><span></mtd> </body> </html> The interesting stuff starts in in nsCSSFrameConstructor::ConstructFrameByDisplayType() when we call ConstructBlock() to setup the floating <span> block frame. (http://lxr.mozilla.org/mozilla/source/layout/base/nsCSSFrameConstructor.cpp#6559) 1. The two important arguments here we pass to ConstructBlock() are aParentFrame and aContentParentFrame. 2. aContentParentFrame is our <mtd>. 3. aParentFrame however, is decided based on the geometric parent (aState.GetGeometricParent()), which in our case will be the mFloatedItems.containingBlock, which is the <body> at this point. 4. Eventually, InitAndRestoreFrame is called on the <span>, which is inited with the <body> as its parent frame. 5. The placeholder frame for the float gets the <mtd> as its parent. 6. Later when we're reflowing, the assertion is firing because the <mtd> block expects itself to be the floating <span>'s parent, but the floating span has the <body> as its parent. In #3, should mFloatedItems.containingBlock have been the <mtd>? Should the placeholder frame and the span in reality have the same parent frame? BTW, on several occasions when testing this, I also hit a possibly related assertion: WARNING: nsBlockFrame::CheckFloats: Explicit float list is out of sync with float cache: file /Users/hakan/Programmering/mozilla/mozilla/layout/generic/nsBlockFrame.cpp, line 6688
The mtd is a table cell, so it should be the float's geometric parent. Somehow we're setting up the wrong geometric parent there.
Summary: "ASSERTION: Float frame has wrong parent" with float in MathML → [FIX]"ASSERTION: Float frame has wrong parent" with float in MathML
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Crashtest checked in.
You need to log in before you can comment on or make changes to this bug.