406485 - Crash [@ nsIFrame::GetNextSibling] with -moz-column, overflowing heights

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase crashes Firefox.  I think this is a regression from within the last few days.


Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xddddddfd

Thread 0 Crashed:
0   nsIFrame::GetNextSibling (nsIFrame.h:800)
1   nsOverflowContinuationTracker::StepForward (nsContainerFrame.cpp:1345)
2   nsOverflowContinuationTracker::Skip (nsContainerFrame.h:518)
3   nsBlockFrame::ReflowDirtyLines (nsBlockFrame.cpp:1943)
4   nsBlockFrame::Reflow (nsBlockFrame.cpp:942)
...

Comment 1

[Boris Zbarsky [:bzbarsky]]

My MOZ_CO_DATE="Sat Dec 1 00:53:00 CST 2007" build (not clean, though) doesn't seem to crash...

Comment 2

[Jesse Ruderman]

I get the same crash loading mozilla/layout/reftests/pagination/dynamic-abspos-overflow-01-cols.xhtml.  I wonder why the Tinderboxen that run reftests aren't aflame.

Boris suspects this is a regression bug 404213, which fantasai fixed last night.

Comment 3

[Jesse Ruderman]

(Boris's regression range is 2007-12-01-02 to 2007-12-02-02.)

Comment 4

[fantasai]

Attachment: patch

That was dumb. Sorry about that. I'll attach a patch for the reftest; it was commented out.

Comment 5

[fantasai]

Attachment: reftest patch

Figured out why the reftest was failing before. This fixes and uncomments it.

Comment 6

[fantasai]

Checked in by bzbarsky, nsContainerFrame.cpp 1.296

Comment 7

[Marcia Knous [:marcia]]

verified fixed using : Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.5; en-US; rv:1.9b2pre) Gecko/2007120504 Minefield/3.0b2pre. I verified using Jesse's testcase, no crash.

Comment 8

[Jeff Walden [:Waldo]]

http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&subdir=mozilla/layout/reftests/pagination&command=DIFF_FRAMESET&file=reftest.list&rev1=1.1&rev2=1.2&root=/cvsroot

Comment 9

[Jesse Ruderman]

No crash on branch.