Closed Bug 429881 Opened 12 years ago Closed 11 years ago

"ASSERTION: Dead placeholder in placeholder map" with -moz-column, r/a/f positioning

Categories

(Core :: Layout, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jruderman, Assigned: jruderman)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, crash, testcase, Whiteboard: [sg:critical?])

Attachments

(1 file)

###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file /Users/jruderman/trunk/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 132

###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 136

###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1104

Crash [@ nsHTMLReflowState::GetNearestContainingBlock] 
or [@ nsCSSFrameConstructor::RemoveFixedItems]
See also bug 428113, which triggers some of the same assertions with a very different testcase.
Depends on: 398332
this still crashes on Windows and Mac with the testcase also after the landing from the Patch in Bug 398332 
OS: Mac OS X → All
Hardware: PC → All
Tomcat, could you pls provide the stack trace for each OS? It'll be interesting to see if it crashes at which one of [@ nsHTMLReflowState::GetNearestContainingBlock] or [@ nsCSSFrameConstructor::RemoveFixedItems].
While this doesn't crash, an assertion about seeing 0xdddddddd is scary enough to warrant [sg:critical?].
Whiteboard: [sg:critical?]
WFM on mozilla-central.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
It still occurs in 1.9.1 and 1.9.0 though.
It was fixed on trunk in the range 2008-12-07-02 -- 2008-12-08-02:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2008-12-07+00%3A01%3A00&enddate=2008-12-08+00%3A03%3A00

Applying the patch in bug 411835 fixes it on 1.9.1
Depends on: 411835
No longer depends on: 398332
Flags: in-testsuite?
Landed a crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b35d611a0dce
Group: core-security
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.