Created attachment 298044 [details] testcase (crashes Firefox when loaded) Loading the testcase triggers: ###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 748 ###!!! ASSERTION: not in child list: 'found', file /Users/jruderman/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 1815 Crash at one of: * nsBlockFrame::CheckFloats dereferencing 0xddddddfd * nsFrameManager::CaptureFrameStateFor dereferencing 0x00000000. Note that bug 399676 also has a testcase that triggers the first assertion. Maybe it's related.
No crash on branch.
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2
For me, if the testcase is downloaded and opened locally, there is no crash (at least in those couple of test launches I did), but the one from bugzilla crashes reliably. body.onload timing?
Nevermind, saved the file with ".xml" extension instead of ".xhtml".
This doesn't crash for me in a newly-updated trunk build. I bet it was fixed with bug 399676.
Yeah, I can see that patch fixing this, since now we have our frame tree all sane.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
Crash Signature: [@ nsBlockFrame::CheckFloats] [@ nsFrameManager::CaptureFrameStateFor]
You need to log in before you can comment on or make changes to this bug.