416165 - Crash [@ no stack] with columns and large border-radius

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes on current trunk build, but the Crash Reporter doesn't come up.
In a debug build, I only get ntd.dll appear, so I guess it's a stack overflow crash or something like that.

It doesn't crash on branch (although I see "text" 2 times, which isn't really a good sign).

If wanted, I can look for the regression range.

Comment 1

[Jesse Ruderman]

###!!! ASSERTION: negative length: 'GetContentEnd() - mContentOffset >= 0', file /Users/jruderman/trunk/mozilla/layout/generic/nsTextFrame.h, line 291

###!!! ASSERTION: comparing iterators over different lists: 'mListLink == aOther.mListLink', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsLineBox.h, line 692

###!!! ASSERTION: Attempting to allocate excessively large array: 'Error', file nsTArray.cpp, line 69

Maybe a dup of bug 411213?

Comment 2

[Jesse Ruderman]

WFM using a Mac trunk build.  No assertions, no crash.  Martijn, are you still seeing this?

Comment 3

[Mats Palmgren (inactive)]

crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ee2e96502593

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ee2e96502593