404213 - "ASSERTION: overflow containers out of order" with -moz-column, relative and absolute positioning

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: overflow containers out of order: '!(mOverflowContList && mOverflowContList->ContainsFrame(aOverflowCont))', file /Users/jruderman/trunk/mozilla/layout/generic/nsContainerFrame.cpp, line 1373

Filing as security-sensitive per bug 399843 comment 2.

Comment 2

[fantasai]

Attachment: patch

There's two problems here: one is that the test condition in the while loop that skips irrelevant frames was incorrect. The other problem is that several parts of the code weren't updated properly to deal with skipped frames. This patch should fix both, and update assertions appropriately.

Comment 3

[Boris Zbarsky [:bzbarsky]]

I think it'd make more sense for roc to review this....

Comment 4

[fantasai]

Fix checked in, nsContainerFrame.cpp rev 1.295

Comment 5

[Daniel Veditz [:dveditz]]

I'm not seeing any assertions on the 1.8 branch with this testcase, but maybe they were added later. Do we need/want this patch on the branch?

What is the severity of this bug as a security issue?

Comment 6

[Boris Zbarsky [:bzbarsky]]

We don't have overflow containers on the branch, so this bug should be a non-issue there, as I understand.  roc, fantasai, please correct me if I'm wrong!

Comment 7

[fantasai]

That's correct; the overflow containers code was added to the 1.9 branch on 2007-07-25 and as a very high-risk change I doubt anyone would have backported it 1.8 branch (especially without telling me) :P

Comment 8

[Daniel Veditz [:dveditz]]

This fix made it into the beta and it's trunk only, removing the security flag.