403245 - "ASSERTION: How did that happen?" with float, first-letter

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: How did that happen?: '!sibling->GetPrevContinuation()', file /Users/jruderman/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 8415

This assertion was added recently, in bug 386642.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Uh, yes.  This would be bad.  GetPrimaryFrameFor() on a text node is finding a continuation textframe!

              Block(body)(1)@0x8a9557c {480,480,76740,0} [state=00101008] [overflow=0,0,960,1380] sc=0x8a9534c(i=1,b=0)<
                line 0x8a95a44: count=3 state=inline,dirty,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0xc341] {960,0,0,0} ca={0,0,960,1380} <
                  Text(0)@0x8a734b0[0,2,T]  next=0x8a95750 {960,0,0,0} [state=08200000] [content=0x8a9bda8] sc=0x8a954dc pst=:-moz-non-element<
                    "\n\n"
                  >
                  Placeholder(div)(1)@0x8a95750 {960,0,0,0} outOfFlowFrame=Area(div)(1)@0x8a956f8
                  Text(2)@0x8a95a04[0,2,T]  {960,0,0,0} [state=08200000] [content=0x89ce3a8] sc=0x8a954dc pst=:-moz-non-element<
                    "\n\n"
                  >
                > floats <
                  placeholder@0x8a95750 Area(div)(1) region={0,0,960,1380}
                >
                Float-list<
                  Area(div)(1)@0x8a956f8 {0,0,960,1380} [state=20d01100] sc=0x8a9552c(i=1,b=0)<
                    line 0x8a959dc: count=2 state=inline,dirty,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x8001] {0,0,0,0} <
                      Placeholder(div)(1)@0x8a792ac {0,0,0,0} [state=00000402] outOfFlowFrame=Letter(div)(1)@0x8a79210
                      Text(1)@0x8a79268[0,2,T]  prev-continuation=0x8a95df8 {0,0,0,0} [state=00000406] [content=0x8a9bea8] sc=0x8a95914 pst=:-moz-non-element<
                        "xy"
                      >
                    >
                    Float-list<
                      Letter(div)(1)@0x8a79210 {0,0,0,0} [state=00000502] [content=0x8a9bde8] [sc=0x8a957d8] pst=:first-letter<
                        Text(1)@0x8a95df8[0,0,F]  next-continuation=0x8a79268 {0,0,0,0} [state=00000402] [content=0x8a9bea8] sc=0x8a8f618 pst=:-moz-non-element<
                          ""
                        >
                      >

(gdb) p mPresShell->GetPrimaryFrameFor(aContent)
$7 = (nsContinuingTextFrame *) 0x8a79268

Comment 2

[Boris Zbarsky [:bzbarsky]]

So the issue is that nsCSSFrameConstructor::FindFrameWithContent doesn't walk through placeholders, and walks fully down the tree on one child list before trying another one.  In other words, it finds the in-flow continuation frame before finding the out-of-flow "real" primary frame.

I think we have two options.  Either we change FindFrameWithContent to walk through placeholders (not sure we want to do this) or replace the assert with a GetFirstContinuation() call to handle this case...

I guess the latter is safe and we should just do it.  roc, any opinions?

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Agree with the latter option.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Let's do it

I'll file a followup bug for fixing FindPrimaryFrameFor.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed.  Filed bug 403425.

Comment 6

[Jesse Ruderman]

Crashtest checked in.