399843 - "ASSERTION: overflow containers out of order or bad parent" and crash with -moz-column, overflowing height

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: overflow containers out of order or bad parent: '!(aOverflowCont->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER)', file /Users/jruderman/trunk/mozilla/layout/generic/nsContainerFrame.cpp, line 1379

###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file /Users/jruderman/trunk/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 132

###!!! ASSERTION: frame was not removed from primary frame map before destruction or was readded to map after being removed: 'Not Reached', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 707

###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 134

###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1098

Crash at one of the following:
[@ nsIFrame::GetParent] 
[@ nsFrameManager::CaptureFrameStateFor]
[@ nsPropertyTable::PropertyList::Equals]
[@ nsFrameList::Destroy]
[@ nsFrameManager::GetPlaceholderFrameFor]

Some of the crashes look [sg:critical].

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

fantasai, can you take this and assign it to yourself?

Comment 2

[fantasai]

The Out-of-Order assertion is getting triggered where we have an overflow containers list in which the next-in-flow has its prev-in-flow as a nextsibling. Haven't yet figured out why.

Jesse - just for future reference, the out-of-order assertion by itself means we have a major problem showing up in this code. It's unlikely that it will /not/ result in a crash.

Comment 3

[fantasai]

Attachment: patch

This code should never pull and insert from the same list. The problem was it wasn't expecting to pull from the overflowContainers list into the same parent's excessOverflowContainers list.

Comment 4

[fantasai]

Fix checked in. nsContainerFrame.cpp rev 1.292

Comment 5

[Jesse Ruderman]

Loading the testcase in a 1.8 branch build doesn't cause any assertion failures.

Comment 6

[Jesse Ruderman]

Crashtest checked in.