416107 - Crash [@ nsFrameManager::UnregisterPlaceholderFrame] with rel&abs pos, display:table-caption

Status: RESOLVED WORKSFORME

(Core :: Layout: Positioned, defect, P3)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase triggers five assertions and a crash.

###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file /Users/jruderman/trunk/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 132

###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 136

###!!! ASSERTION: no placeholder frame for out-of-flow frame: 'Not Reached', file /Users/jruderman/trunk/mozilla/layout/generic/nsFrame.cpp, line 5529

###!!! ASSERTION: No placeholder for out-of-flow?: 'placeholderFrame', file /Users/jruderman/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9601

###!!! ASSERTION: null param unexpected: 'aPlaceholderFrame', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 512

The crash seems to be a consistent null deref, but the "Dead placeholder in placeholder map" assertion scares me, so I'm filing as security-sensitive.

Comment 1

[Bernd]

wfm no crash  no assert

Comment 2

[Jesse Ruderman]

Still asserts and crashes for me.

Comment 3

[Daniel Holbert [:dholbert]]

(In reply to comment #1)
> wfm no crash  no assert

WFM too, using a trunk build checked out yesterday, on both Mac OS X and Linux.

Comment 4

[Jesse Ruderman]

Works for me now too.  I'll check in a crashtest when this bug is no longer security-sensitive.

Comment 5

[Mats Palmgren (inactive)]

Landed the crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fca9033055cc

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/fca9033055cc