Created attachment 312585 [details] testcase Loading the testcase triggers: ###!!! ASSERTION: Should have dealt with kids that have NS_FRAME_IS_SPECIAL elsewhere: 'aChildPseudo != nsCSSAnonBoxes::mozAnonymousBlock && aChildPseudo != nsCSSAnonBoxes::mozAnonymousPositionedBlock', file /Users/jruderman/trunk/mozilla/layout/generic/nsFrame.cpp, line 5477 bz fixed an instance of this assertion in bug 377824, but the testcases are totally different.
So the problem is that GetIBSpecialSibling on the mozAnonymousBlock frame is null. That's bad. Shouldn't happen, at all.
So how come all these frames are still in the tree? When we remove the firstChild of the columnated div, they should all go away.
Patch in bug 413048 fixes this. Once it lands, we should check in this crashtest.
Depends on: 413048
Crashtest coming soon.
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
Crashtest added: http://hg.mozilla.org/mozilla-central/rev/aad5b1c64ed4
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.