Created attachment 284916 [details] testcase Loading the testcase triggers: ###!!! ASSERTION: overflow containers out of order or bad parent: '!(aOverflowCont->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER)', file /Users/jruderman/trunk/mozilla/layout/generic/nsContainerFrame.cpp, line 1379 ###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file /Users/jruderman/trunk/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 132 ###!!! ASSERTION: frame was not removed from primary frame map before destruction or was readded to map after being removed: 'Not Reached', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 707 ###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 134 ###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1098 Crash at one of the following: [@ nsIFrame::GetParent] [@ nsFrameManager::CaptureFrameStateFor] [@ nsPropertyTable::PropertyList::Equals] [@ nsFrameList::Destroy] [@ nsFrameManager::GetPlaceholderFrameFor] Some of the crashes look [sg:critical].
Flags: blocking1.9? → blocking1.9+
fantasai, can you take this and assign it to yourself?
Whiteboard: [sg:critical] → [sg:critical][dbaron-1.9:RsCo]
Priority: -- → P3
The Out-of-Order assertion is getting triggered where we have an overflow containers list in which the next-in-flow has its prev-in-flow as a nextsibling. Haven't yet figured out why. Jesse - just for future reference, the out-of-order assertion by itself means we have a major problem showing up in this code. It's unlikely that it will /not/ result in a crash.
Status: NEW → ASSIGNED
Created attachment 288787 [details] [diff] [review] patch This code should never pull and insert from the same list. The problem was it wasn't expecting to pull from the overflowContainers list into the same parent's excessOverflowContainers list.
Fix checked in. nsContainerFrame.cpp rev 1.292
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
Loading the testcase in a 1.8 branch build doesn't cause any assertion failures.
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.