"ASSERTION: running past end" with -moz-column, float, removing abs pos

VERIFIED WORKSFORME

Status

()

defect
P2
critical
VERIFIED WORKSFORME
12 years ago
6 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

(Blocks 1 bug, {assertion, testcase})

Trunk
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9 -
wanted1.9.0.x -
wanted1.8.1.x ?
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?])

Attachments

(1 attachment)

Posted file testcase
Loading the testcase triggers:

###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 1388

###!!! ASSERTION: running past end: 'mCurrent != mListLink', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsLineBox.h, line 612

I don't know what happens after the "running past end" assertion because I have it set to abort.
What happens after the assertion is non-deterministic.  Sometimes the asserts happen, you can close, and everything goes fine.  Sometimes the asserts happen and you get a shutdown crash:

Thread 0 Crashed:
0   libmozjs.dylib      	0x013f37bb JS_HashTableRawLookup + 101 (jshash.c:179)
1   libmozjs.dylib      	0x01474f0d js_PurgeDeflatedStringCache + 74 (jsstr.c:2592)
2   libmozjs.dylib      	0x01475247 js_FinalizeStringRT + 505 (jsstr.c:2667)
3   libmozjs.dylib      	0x013f2f84 js_GC + 3051 (jsgc.c:3354)
4   libmozjs.dylib      	0x013a8bb9 JS_GC + 85 (jsapi.c:2436)
5   XUL                 	0x00218517 nsXREDirProvider::DoShutdown() + 465 (nsXREDirProvider.cpp:866)
6   XUL                 	0x002079f8 ScopedXPCOMStartup::~ScopedXPCOMStartup [in-charge]() + 124 (nsAppRunner.cpp:907)
7   XUL                 	0x0020f44d XRE_main + 8995 (nsAppRunner.cpp:3195)
8   org.mozilla.firefox 	0x00002798 main + 708 (nsBrowserApp.cpp:158)
9   org.mozilla.firefox 	0x00001dca _start + 216
10  org.mozilla.firefox 	0x00001cf1 start + 41

Other times you just get an immediate crash, as happened when I generated these stacks/asserts:

###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp, line 1388
nsBlockFrame::ComputeFinalSize(nsHTMLReflowState const&, nsBlockReflowState&, nsHTMLReflowMetrics&) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:1387)
nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:1093)
nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsContainerFrame.cpp:771)
CanvasFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsHTMLFrame.cpp:584)
nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsContainerFrame.cpp:771)
nsHTMLScrollFrame::ReflowScrolledFrame(ScrollReflowState*, int, int, nsHTMLReflowMetrics*, int) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsGfxScrollFrame.cpp:496)
nsHTMLScrollFrame::ReflowContents(ScrollReflowState*, nsHTMLReflowMetrics const&) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsGfxScrollFrame.cpp:590)
nsHTMLScrollFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsGfxScrollFrame.cpp:789)
nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsContainerFrame.cpp:771)
ViewportFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsViewportFrame.cpp:286)
PresShell::DoReflow(nsIFrame*) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:6260)
PresShell::ProcessReflowCommands(int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:6365)
PresShell::DoFlushPendingNotifications(mozFlushType, int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:4553)
PresShell::FlushPendingNotifications(mozFlushType) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:4493)
nsDocument::FlushPendingNotifications(mozFlushType) (/Users/jwalden/moz/clean/mozilla/content/base/src/nsDocument.cpp:4893)
nsGenericElement::GetPrimaryFrame(mozFlushType) (/Users/jwalden/moz/clean/mozilla/content/base/src/nsGenericElement.cpp:2929)
GetStyledFrameFor(nsGenericHTMLElement*) (/Users/jwalden/moz/clean/mozilla/content/html/content/src/nsGenericHTMLElement.cpp:121)
nsGenericHTMLElement::GetOffsetRect(nsRect&, nsIContent**) (/Users/jwalden/moz/clean/mozilla/content/html/content/src/nsGenericHTMLElement.cpp:502)
nsGenericHTMLElement::GetOffsetHeight(int*) (/Users/jwalden/moz/clean/mozilla/content/html/content/src/nsGenericHTMLElement.cpp:646)
gfxImageSurface::Data()+0x0000CC29  (/Users/jwalden/moz/builds/clean/intl/unicharutil/util/internal/../../../../dist/include/xpcom/nsCOMPtr.h:196)
NS_InvokeByIndex_P (/Users/jwalden/moz/clean/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179)
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2369)
nsCRT::IsUpper(char)+0x000014F9  (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcprivate.h:2256)
XPC_WN_GetterSetter(JSContext*, JSObject*, unsigned int, long*, long*) (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1502)
js_Invoke (/Users/jwalden/moz/clean/mozilla/js/src/jsinvoke.c:1275)
js_InternalInvoke (/Users/jwalden/moz/clean/mozilla/js/src/jsinvoke.c:1347)
js_InternalGetOrSet (/Users/jwalden/moz/clean/mozilla/js/src/jsinvoke.c:1405)
js_NativeGet (/Users/jwalden/moz/clean/mozilla/js/src/jsobj.c:3528)
js_GetPropertyHelper (/Users/jwalden/moz/clean/mozilla/js/src/jsobj.c:3677)
js_Interpret (/Users/jwalden/moz/clean/mozilla/js/src/jsinterp.c:4229)
js_Invoke (/Users/jwalden/moz/clean/mozilla/js/src/jsinvoke.c:1291)
js_InternalInvoke (/Users/jwalden/moz/clean/mozilla/js/src/jsinvoke.c:1347)
JS_CallFunctionValue (/Users/jwalden/moz/clean/mozilla/js/src/jsapi.c:5024)
nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) (/Users/jwalden/moz/clean/mozilla/dom/src/base/nsJSEnvironment.cpp:1961)
nsJSEventListener::HandleEvent(nsIDOMEvent*) (/Users/jwalden/moz/clean/mozilla/dom/src/events/nsJSEventListener.cpp:248)
nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsISupports*, unsigned int) (/Users/jwalden/moz/clean/mozilla/content/events/src/nsEventListenerManager.cpp:1082)
nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsISupports*, unsigned int, nsEventStatus*) (/Users/jwalden/moz/clean/mozilla/content/events/src/nsEventListenerManager.cpp:1186)
nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int) (/Users/jwalden/moz/clean/mozilla/content/events/src/nsEventDispatcher.cpp:206)
nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*) (/Users/jwalden/moz/clean/mozilla/content/events/src/nsEventDispatcher.cpp:264)
nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) (/Users/jwalden/moz/clean/mozilla/content/events/src/nsEventDispatcher.cpp:479)
DocumentViewerImpl::LoadComplete(unsigned int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsDocumentViewer.cpp:979)
nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned int) (/Users/jwalden/moz/clean/mozilla/docshell/base/nsDocShell.cpp:5025)
nsWebShell::EndPageLoad(nsIWebProgress*, nsIChannel*, unsigned int) (/Users/jwalden/moz/clean/mozilla/docshell/base/nsWebShell.cpp:1013)
nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, unsigned int) (/Users/jwalden/moz/clean/mozilla/docshell/base/nsDocShell.cpp:4930)
nsDocLoader::FireOnStateChange(nsIWebProgress*, nsIRequest*, int, unsigned int) (/Users/jwalden/moz/clean/mozilla/uriloader/base/nsDocLoader.cpp:1235)
nsDocLoader::doStopDocumentLoad(nsIRequest*, unsigned int) (/Users/jwalden/moz/clean/mozilla/uriloader/base/nsDocLoader.cpp:858)
nsDocLoader::DocLoaderIsEmpty() (/Users/jwalden/moz/clean/mozilla/uriloader/base/nsDocLoader.cpp:763)
nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) (/Users/jwalden/moz/clean/mozilla/uriloader/base/nsDocLoader.cpp:679)
nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, unsigned int) (/Users/jwalden/moz/clean/mozilla/netwerk/base/src/nsLoadGroup.cpp:688)
nsDocument::DoUnblockOnload() (/Users/jwalden/moz/clean/mozilla/content/base/src/nsDocument.cpp:5643)
nsDocument::UnblockOnload(int) (/Users/jwalden/moz/clean/mozilla/content/base/src/nsDocument.cpp:5592)
nsDocument::DispatchContentLoadedEvents() (/Users/jwalden/moz/clean/mozilla/content/base/src/nsDocument.cpp:2845)
nsStringArray::AppendString(nsAString_internal const&)+0x00007E31  (/Users/jwalden/moz/builds/clean/intl/unicharutil/util/internal/../../../dist/include/xpcom/nsThreadUtils.h:261)
nsThread::ProcessNextEvent(int, int*) (/Users/jwalden/moz/clean/mozilla/xpcom/threads/nsThread.cpp:510)
NS_ProcessPendingEvents_P(nsIThread*, unsigned int) (/Users/jwalden/moz/builds/clean/xpcom/build/nsThreadUtils.cpp:180)
nsBaseAppShell::NativeEventCallback() (/Users/jwalden/moz/clean/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:107)
nsAppShell::ProcessGeckoEvents(void*) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsAppShell.mm:305)
CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunInMode (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
BlockUntilNextEventMatchingListInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
_DPSNextEvent (Text.subproj/TextGlobals.m:)
-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (Text.subproj/TextGlobals.m:)
-[NSApplication run] (Text.subproj/TextGlobals.m:)
nsAppShell::Run() (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsAppShell.mm:587)
nsAppStartup::Run() (/Users/jwalden/moz/clean/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181)
XRE_main (/Users/jwalden/moz/clean/mozilla/toolkit/xre/nsAppRunner.cpp:3154)
main (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:158)
_start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
###!!! ASSERTION: running past end: 'mCurrent != mListLink', file /Users/jwalden/moz/clean/mozilla/layout/base/../generic/nsLineBox.h, line 611
nsCOMArray_base::ObjectAt(int) const+0x00005AAD  (/Users/jwalden/moz/clean/mozilla/layout/base/../generic/nsLineBox.h:611)
nsBlockFrame::MarkLineDirty(nsLineList_iterator) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:1460)
nsBlockFrame::ChildIsDirty(nsIFrame*) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:6253)
PresShell::FrameNeedsReflow(nsIFrame*, nsIPresShell::IntrinsicDirty, unsigned int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:3279)
nsCSSFrameConstructor::StyleChangeReflow(nsIFrame*) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:9901)
nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList&) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:10019)
nsCSSFrameConstructor::RestyleElement(nsIContent*, nsIFrame*, nsChangeHint) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:10079)
nsCSSFrameConstructor::ProcessOneRestyle(nsIContent*, nsReStyleHint, nsChangeHint) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:13388)
nsCSSFrameConstructor::ProcessPendingRestyles() (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:13482)
PresShell::DoFlushPendingNotifications(mozFlushType, int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:4527)
PresShell::WillPaint() (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:5988)
nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) (/Users/jwalden/moz/clean/mozilla/view/src/nsViewManager.cpp:1116)
HandleEvent(nsGUIEvent*) (/Users/jwalden/moz/clean/mozilla/view/src/nsView.cpp:168)
nsChildView::DispatchEvent(nsGUIEvent*, nsEventStatus&) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:1548)
nsChildView::DispatchWindowEvent(nsGUIEvent&) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:1561)
-[ChildView drawRect:] (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:2555)
-[NSView _drawRect:clip:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] (Text.subproj/TextGlobals.m:)
-[NSView displayIfNeeded] (Text.subproj/TextGlobals.m:)
-[NSWindow displayIfNeeded] (Text.subproj/TextGlobals.m:)
_handleWindowNeedsDisplay (Text.subproj/TextGlobals.m:)
__CFRunLoopDoObservers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunInMode (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
BlockUntilNextEventMatchingListInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
_DPSNextEvent (Text.subproj/TextGlobals.m:)
-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (Text.subproj/TextGlobals.m:)
-[NSApplication run] (Text.subproj/TextGlobals.m:)
nsAppShell::Run() (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsAppShell.mm:587)
nsAppStartup::Run() (/Users/jwalden/moz/clean/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181)
XRE_main (/Users/jwalden/moz/clean/mozilla/toolkit/xre/nsAppRunner.cpp:3154)
main (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:158)
_start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
###!!! ASSERTION: running past end: 'mCurrent != mListLink', file /Users/jwalden/moz/clean/mozilla/layout/base/../generic/nsLineBox.h, line 611
nsCOMArray_base::ObjectAt(int) const+0x00005AAD  (/Users/jwalden/moz/clean/mozilla/layout/base/../generic/nsLineBox.h:611)
nsBlockFrame::MarkLineDirty(nsLineList_iterator) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:1463)
nsBlockFrame::ChildIsDirty(nsIFrame*) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:6253)
PresShell::FrameNeedsReflow(nsIFrame*, nsIPresShell::IntrinsicDirty, unsigned int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:3279)
nsCSSFrameConstructor::StyleChangeReflow(nsIFrame*) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:9901)
nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList&) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:10019)
nsCSSFrameConstructor::RestyleElement(nsIContent*, nsIFrame*, nsChangeHint) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:10079)
nsCSSFrameConstructor::ProcessOneRestyle(nsIContent*, nsReStyleHint, nsChangeHint) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:13388)
nsCSSFrameConstructor::ProcessPendingRestyles() (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:13482)
PresShell::DoFlushPendingNotifications(mozFlushType, int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:4527)
PresShell::WillPaint() (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:5988)
nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) (/Users/jwalden/moz/clean/mozilla/view/src/nsViewManager.cpp:1116)
HandleEvent(nsGUIEvent*) (/Users/jwalden/moz/clean/mozilla/view/src/nsView.cpp:168)
nsChildView::DispatchEvent(nsGUIEvent*, nsEventStatus&) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:1548)
nsChildView::DispatchWindowEvent(nsGUIEvent&) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:1561)
-[ChildView drawRect:] (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:2555)
-[NSView _drawRect:clip:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] (Text.subproj/TextGlobals.m:)
-[NSView displayIfNeeded] (Text.subproj/TextGlobals.m:)
-[NSWindow displayIfNeeded] (Text.subproj/TextGlobals.m:)
_handleWindowNeedsDisplay (Text.subproj/TextGlobals.m:)
__CFRunLoopDoObservers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunInMode (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
BlockUntilNextEventMatchingListInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
_DPSNextEvent (Text.subproj/TextGlobals.m:)
-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (Text.subproj/TextGlobals.m:)
-[NSApplication run] (Text.subproj/TextGlobals.m:)
nsAppShell::Run() (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsAppShell.mm:587)
nsAppStartup::Run() (/Users/jwalden/moz/clean/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181)
XRE_main (/Users/jwalden/moz/clean/mozilla/toolkit/xre/nsAppRunner.cpp:3154)
main (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:158)
_start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
###!!! ASSERTION: running past end: 'mCurrent != mListLink', file /Users/jwalden/moz/clean/mozilla/layout/base/../generic/nsLineBox.h, line 611
nsCOMArray_base::ObjectAt(int) const+0x00005AAD  (/Users/jwalden/moz/clean/mozilla/layout/base/../generic/nsLineBox.h:611)
nsBlockFrame::MarkLineDirty(nsLineList_iterator) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:1464)
nsBlockFrame::ChildIsDirty(nsIFrame*) (/Users/jwalden/moz/clean/mozilla/layout/generic/nsBlockFrame.cpp:6253)
PresShell::FrameNeedsReflow(nsIFrame*, nsIPresShell::IntrinsicDirty, unsigned int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:3279)
nsCSSFrameConstructor::StyleChangeReflow(nsIFrame*) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:9901)
nsCSSFrameConstructor::ProcessRestyledFrames(nsStyleChangeList&) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:10019)
nsCSSFrameConstructor::RestyleElement(nsIContent*, nsIFrame*, nsChangeHint) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:10079)
nsCSSFrameConstructor::ProcessOneRestyle(nsIContent*, nsReStyleHint, nsChangeHint) (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:13388)
nsCSSFrameConstructor::ProcessPendingRestyles() (/Users/jwalden/moz/clean/mozilla/layout/base/nsCSSFrameConstructor.cpp:13482)
PresShell::DoFlushPendingNotifications(mozFlushType, int) (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:4527)
PresShell::WillPaint() (/Users/jwalden/moz/clean/mozilla/layout/base/nsPresShell.cpp:5988)
nsViewManager::DispatchEvent(nsGUIEvent*, nsEventStatus*) (/Users/jwalden/moz/clean/mozilla/view/src/nsViewManager.cpp:1116)
HandleEvent(nsGUIEvent*) (/Users/jwalden/moz/clean/mozilla/view/src/nsView.cpp:168)
nsChildView::DispatchEvent(nsGUIEvent*, nsEventStatus&) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:1548)
nsChildView::DispatchWindowEvent(nsGUIEvent&) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:1561)
-[ChildView drawRect:] (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsChildView.mm:2555)
-[NSView _drawRect:clip:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
_recursiveDisplayInRect2 (Text.subproj/TextGlobals.m:)
CFArrayApplyFunction (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
-[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] (Text.subproj/TextGlobals.m:)
-[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] (Text.subproj/TextGlobals.m:)
-[NSView displayIfNeeded] (Text.subproj/TextGlobals.m:)
-[NSWindow displayIfNeeded] (Text.subproj/TextGlobals.m:)
_handleWindowNeedsDisplay (Text.subproj/TextGlobals.m:)
__CFRunLoopDoObservers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunInMode (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
BlockUntilNextEventMatchingListInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
_DPSNextEvent (Text.subproj/TextGlobals.m:)
-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (Text.subproj/TextGlobals.m:)
-[NSApplication run] (Text.subproj/TextGlobals.m:)
nsAppShell::Run() (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsAppShell.mm:587)
nsAppStartup::Run() (/Users/jwalden/moz/clean/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181)
XRE_main (/Users/jwalden/moz/clean/mozilla/toolkit/xre/nsAppRunner.cpp:3154)
main (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:158)
_start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
###!!! ASSERTION: bad: '!IsMarked()', file /Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcinlines.h, line 594
nsCRT::IsUpper(char)+0x0000184C  (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcinlines.h:594)
nsCRT::IsUpper(char)+0x000018D8  (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcprivate.h:1952)
nsCRT::IsUpper(char)+0x00001927  (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcprivate.h:2305)
ASSERT_WrappedNativeSetNotMarked(JSDHashTable*, JSDHashEntryHdr*, unsigned int, void*) (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp:543)
JS_DHashTableEnumerate (/Users/jwalden/moz/clean/mozilla/js/src/jsdhash.c:716)
nsVoidArray::AppendElement(void*)+0x000010DF  (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcmaps.h:212)
XPCWrappedNativeScope::ASSERT_NoInterfaceSetsAreMarked() (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp:562)
XPCJSRuntime::GCCallback(JSContext*, JSGCStatus) (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/xpcjsruntime.cpp:689)
DOMGCCallback(JSContext*, JSGCStatus) (/Users/jwalden/moz/clean/mozilla/dom/src/base/nsJSEnvironment.cpp:3516)
XPCCycleCollectGCCallback(JSContext*, JSGCStatus) (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/nsXPConnect.cpp:455)
js_GC (/Users/jwalden/moz/clean/mozilla/js/src/jsgc.c:3439)
JS_GC (/Users/jwalden/moz/clean/mozilla/js/src/jsapi.c:2435)
nsXPConnect::Collect() (/Users/jwalden/moz/clean/mozilla/js/src/xpconnect/src/nsXPConnect.cpp:526)
nsCycleCollector::Collect(unsigned int) (/Users/jwalden/moz/clean/mozilla/xpcom/base/nsCycleCollector.cpp:2192)
nsCycleCollector_collect() (/Users/jwalden/moz/clean/mozilla/xpcom/base/nsCycleCollector.cpp:2816)
nsJSContext::CC() (/Users/jwalden/moz/clean/mozilla/dom/src/base/nsJSEnvironment.cpp:3345)
nsUserActivityObserver::Observe(nsISupports*, char const*, unsigned short const*) (/Users/jwalden/moz/clean/mozilla/dom/src/base/nsJSEnvironment.cpp:270)
nsObserverList::NotifyObservers(nsISupports*, char const*, unsigned short const*) (/Users/jwalden/moz/clean/mozilla/xpcom/ds/nsObserverList.cpp:128)
nsObserverService::NotifyObservers(nsISupports*, char const*, unsigned short const*) (/Users/jwalden/moz/clean/mozilla/xpcom/ds/nsObserverService.cpp:181)
nsUITimerCallback::Notify(nsITimer*) (/Users/jwalden/moz/clean/mozilla/content/events/src/nsEventStateManager.cpp:207)
nsTimerImpl::Fire() (/Users/jwalden/moz/clean/mozilla/xpcom/threads/nsTimerImpl.cpp:403)
nsTimerEvent::Run() (/Users/jwalden/moz/clean/mozilla/xpcom/threads/nsTimerImpl.cpp:490)
nsThread::ProcessNextEvent(int, int*) (/Users/jwalden/moz/clean/mozilla/xpcom/threads/nsThread.cpp:510)
NS_ProcessPendingEvents_P(nsIThread*, unsigned int) (/Users/jwalden/moz/builds/clean/xpcom/build/nsThreadUtils.cpp:180)
nsBaseAppShell::NativeEventCallback() (/Users/jwalden/moz/clean/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:107)
nsAppShell::ProcessGeckoEvents(void*) (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsAppShell.mm:305)
CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
CFRunLoopRunInMode (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation)
RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
BlockUntilNextEventMatchingListInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox)
_DPSNextEvent (Text.subproj/TextGlobals.m:)
-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (Text.subproj/TextGlobals.m:)
-[NSApplication run] (Text.subproj/TextGlobals.m:)
nsAppShell::Run() (/Users/jwalden/moz/clean/mozilla/widget/src/cocoa/nsAppShell.mm:587)
nsAppStartup::Run() (/Users/jwalden/moz/clean/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181)
XRE_main (/Users/jwalden/moz/clean/mozilla/toolkit/xre/nsAppRunner.cpp:3154)
main (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:158)
_start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)
start (/Users/jwalden/moz/clean/mozilla/browser/app/nsBrowserApp.cpp:61)

...with this stack when the crash occurred, apparently more or less immediately after the last assertion:

Thread 0 Crashed:
0   libxpconnect.dylib       	0x34fe0013 XPCNativeInterface::IsMarked() const + 9 (xpcprivate.h:1500)
1   libxpconnect.dylib       	0x34fe7401 XPCNativeSet::ASSERT_NotMarked() + 119 (xpcinlines.h:599)
2   libxpconnect.dylib       	0x34fe7468 XPCWrappedNativeProto::ASSERT_SetNotMarked() const + 20 (xpcprivate.h:1952)
3   libxpconnect.dylib       	0x34fe74b7 XPCWrappedNative::ASSERT_SetsNotMarked() const + 59 (xpcprivate.h:2305)
4   libxpconnect.dylib       	0x34fb70b2 ASSERT_WrappedNativeSetNotMarked(JSDHashTable*, JSDHashEntryHdr*, unsigned, void*) + 20 (xpcwrappednativescope.cpp:544)
5   libmozjs.dylib           	0x013ca69d JS_DHashTableEnumerate + 191 (jsdhash.c:716)
6   libxpconnect.dylib       	0x34fd5b91 Native2WrappedNativeMap::Enumerate(JSDHashOperator (*)(JSDHashTable*, JSDHashEntryHdr*, unsigned, void*), void*) + 33 (xpcmaps.h:212)
7   libxpconnect.dylib       	0x34fb710f XPCWrappedNativeScope::ASSERT_NoInterfaceSetsAreMarked() + 57 (xpcwrappednativescope.cpp:564)
8   libxpconnect.dylib       	0x34f926e6 XPCJSRuntime::GCCallback(JSContext*, JSGCStatus) + 1210 (xpcjsruntime.cpp:705)
9   libgklayout.dylib        	0x15ae6bf9 DOMGCCallback(JSContext*, JSGCStatus) + 47 (nsJSEnvironment.cpp:3516)
10  libxpconnect.dylib       	0x34f6f470 XPCCycleCollectGCCallback(JSContext*, JSGCStatus) + 262 (nsXPConnect.cpp:455)
11  libmozjs.dylib           	0x013f31ab js_GC + 3602 (jsgc.c:3464)
12  libmozjs.dylib           	0x013a8bb9 JS_GC + 85 (jsapi.c:2436)
13  libxpconnect.dylib       	0x34f6ba7a nsXPConnect::Collect() + 248 (nsXPConnect.cpp:527)
14  libxpcom_core.dylib      	0x0173b058 nsCycleCollector::Collect(unsigned) + 246 (nsCycleCollector.cpp:2192)
15  libxpcom_core.dylib      	0x0173b13e nsCycleCollector_collect() + 48 (nsCycleCollector.cpp:2816)
16  libgklayout.dylib        	0x15ae6950 nsJSContext::CC() + 88 (nsJSEnvironment.cpp:3345)
17  libgklayout.dylib        	0x15ae96ba nsUserActivityObserver::Observe(nsISupports*, char const*, unsigned short const*) + 174 (nsJSEnvironment.cpp:271)
18  libxpcom_core.dylib      	0x016df46d nsObserverList::NotifyObservers(nsISupports*, char const*, unsigned short const*) + 97 (nsObserverList.cpp:127)
19  libxpcom_core.dylib      	0x016dfb17 nsObserverService::NotifyObservers(nsISupports*, char const*, unsigned short const*) + 333 (nsObserverService.cpp:184)
20  libgklayout.dylib        	0x1597fb8f nsUITimerCallback::Notify(nsITimer*) + 271 (nsEventStateManager.cpp:205)
21  libxpcom_core.dylib      	0x0172df75 nsTimerImpl::Fire() + 1027 (nsTimerImpl.cpp:404)
22  libxpcom_core.dylib      	0x0172e187 nsTimerEvent::Run() + 191 (nsTimerImpl.cpp:492)
23  libxpcom_core.dylib      	0x01729dff nsThread::ProcessNextEvent(int, int*) + 675 (nsThread.cpp:511)
24  libxpcom_core.dylib      	0x016cd88b NS_ProcessPendingEvents_P(nsIThread*, unsigned) + 145 (nsThreadUtils.cpp:180)
25  libwidget_mac.dylib      	0x3448d08c nsBaseAppShell::NativeEventCallback() + 104 (nsBaseAppShell.cpp:108)
26  libwidget_mac.dylib      	0x3445910b nsAppShell::ProcessGeckoEvents(void*) + 517 (nsAppShell.mm:306)
27  com.apple.CoreFoundation 	0x9082cf1a CFRunLoopRunSpecific + 1213
28  com.apple.CoreFoundation 	0x9082ca56 CFRunLoopRunInMode + 61
29  com.apple.HIToolbox      	0x92df5878 RunCurrentEventLoopInMode + 285
30  com.apple.HIToolbox      	0x92df4f82 ReceiveNextEventCommon + 385
31  com.apple.HIToolbox      	0x92df4dd9 BlockUntilNextEventMatchingListInMode + 81
32  com.apple.AppKit         	0x9329c485 _DPSNextEvent + 572
33  com.apple.AppKit         	0x9329c076 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 137
34  com.apple.AppKit         	0x93295dfb -[NSApplication run] + 512
35  libwidget_mac.dylib      	0x34457bd1 nsAppShell::Run() + 287 (nsAppShell.mm:587)
36  libtoolkitcomps.dylib    	0x336d187f nsAppStartup::Run() + 147 (nsAppStartup.cpp:181)
37  XUL                      	0x002107d0 XRE_main + 13990 (nsAppRunner.cpp:3154)
38  org.mozilla.firefox      	0x00002798 main + 708 (nsBrowserApp.cpp:158)
39  org.mozilla.firefox      	0x00001dca _start + 216
40  org.mozilla.firefox      	0x00001cf1 start + 41

The testcase is clearly causing heap corruption.
Whiteboard: [sg:critical?]
Flags: blocking1.9?
+'ing this w/ P2.  Roc, feel free to adjust as I know your view on such bugs this late in the game.
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2
Is there a reason why we should make this one block when we've minused the others?
Roc, If you feel there's no special reason block, as was in the case with the others, please minus.  
OK, just checking that you didn't have such a reason.
Flags: blocking1.9+ → blocking1.9-
WFM on trunk.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: wanted1.9.0.x?
Resolution: --- → WORKSFORME
Verified fixed with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1a2pre) Gecko/20080816113032 Minefield/3.1a2pre
Status: RESOLVED → VERIFIED
Oops, I meant verified WFM.
Er, is this still an issue with Firefox 3? If so, do we know what fixed it on trunk?
Flags: wanted1.9.0.x?
No, it's not an issue with Firefox 3.  Yes, bug 404215.

I can reproduce the assertion and crash in:
CVS trunk MOZ_CO_DATE=2008-04-18 debug build on OSX.
but not in:
CVS trunk MOZ_CO_DATE=2008-04-19 debug build on OSX.

CVS trunk changes between 2008-04-18 -- 2008-04-19:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-04-18&maxdate=2008-04-19&cvsroot=%2Fcvsroot

Applying the patch in bug 404215 to the 2008-04-18 build fixes it.
Depends on: 404215
Flags: wanted1.9.0.x-
Flags: wanted1.8.1.x?
Group: core-security
Flags: in-testsuite?
crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/76f59678698b
Flags: in-testsuite? → in-testsuite+
Assignee: jruderman → nobody
You need to log in before you can comment on or make changes to this bug.