413582 - "ASSERTION: Leaking overflow placeholder frames" with -moz-column, float

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: unexpected frame type: 'Not Reached', file 

###!!! ASSERTION: reflow dirty lines failed: 'NS_SUCCEEDED(rv)', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 937

###!!! ASSERTION: Leaking overflow placeholder frames: 'mOverflowPlaceholders.IsEmpty()', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockReflowState.cpp, line 160

Reloading or closing the testcase triggers:

###!!! ASSERTION: Some objects allocated with AllocateFrame were not freed: 'mFrameCount == 0', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 673

A bunch of stuff leaks, including an nsGenericElement.

I don't know whether this is a security hole.

Comment 1

[Jesse Ruderman]

Bug 409565 also triggers the first two assertions, so it might be related.

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase2

This is probably the same or a related bug, I see this assertion and some other assertions with this testcase, using current trunk build. The testcase also seems to leak.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcase in comment #0 WFM on Mac trunk Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1a2pre) Gecko/20080818150509 Minefield/3.1a2pre with mallocscribble.  No assertions / crashes / leaks at all.

Comment 4

[Jesse Ruderman]

I'm not seeing any assertions, crashes, or trace-malloc leaks with either testcase.  WFM.

Comment 5

[Samuel Sidler (old account; do not CC)]

Does this bug still occur on the 1.9.0 branch? Any reason not to open this bug up?

Comment 6

[Jesse Ruderman]

WFM on 1.9.0 too.  I'll check in a crashtest or two when things are more green and open.

Comment 7

[Samuel Sidler (old account; do not CC)]

Clearing wanted flag then.