420213 - Crash [@ nsLayoutUtils::GetFloatFromPlaceholder] with -moz-column, float

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: can't find deleted frame in lines: 'Error', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 5355

###!!! ASSERTION: Somehow we failed to fit all content, even though we have unlimited space!: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 955

###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 175

Thread 0 Crashed:
0   nsIFrame::GetStyleDisplay() const + 15 (nsStyleStructList.h:95)
1   nsLayoutUtils::GetFloatFromPlaceholder(nsIFrame*) + 87 (nsLayoutUtils.cpp:227)
2   nsBlockFrame::CollectFloats(nsIFrame*, nsFrameList&, nsIFrame**, int, int) + 61 (nsBlockFrame.cpp:6664)
...

Comment 1

[Martijn Wargers (dead)]

Related to bug 401734?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Testcase in comment #0 WFM on Mac trunk Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1a2pre) Gecko/20080818150509 Minefield/3.1a2pre with mallocscribble. No assertions / crashes at all.

Comment 3

[Jesse Ruderman]

WFM, Firefox trunk on Tiger.