399715 - "ASSERTION: Null out-of-flow for placeholder?" with xul tree, float

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 175

Comment 1

[Boris Zbarsky [:bzbarsky]]

#7  0xb674ed28 in PresShell::GetPrimaryFrameFor (this=0x8c17f88, aContent=0x8c36300)
    at ../../../mozilla/layout/base/nsPresShell.cpp:4745
#8  0xb69353a9 in nsBoxObject::GetFrame (this=0x8c31ea4, aFlushLayout=0)
    at ../../../../../mozilla/layout/xul/base/src/nsBoxObject.cpp:141
#9  0xb6d219a4 in nsTreeBoxObject::GetTreeBody (this=0x8c31ea0)
    at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp:116
#10 0xb6d22078 in nsTreeBoxObject::GetColumns (this=0x8c31ea0, aColumns=0xbfffd910)
    at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp:234
#11 0xb6d237d5 in nsTreeColFrame::InvalidateColumns (this=0x8c3094c)
    at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp:228
#12 0xb6d231cc in nsTreeColFrame::Destroy (this=0x8c3094c)
    at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp:102

Then we start walking a partially-destroyed frame tree, and it's all bad from there.

I'm sure we already have bugs on this....

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

See https://bugzilla.mozilla.org/show_bug.cgi?id=391178#c5 and following... not sure which way the dependency should go, but marking a relationship.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Reassigning to dholbert since 391178 is his and is where we'll be fixing this, I think.

Comment 4

[Daniel Holbert [:dholbert]]

Fixed by checkin of bug 391178.

Comment 5

[Jesse Ruderman]

Crashtest checked in.