436602 - "ASSERTION: Not enough frames to push" and crash [@ nsLineBox::nsLineBox] with -moz-column, float

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase triggers an assertion failure and a crash.

###!!! ASSERTION: Not enough frames to push: 'nsFrameList(aFrame).GetLength() >= pushCount', file /Users/jruderman/central/mozilla/layout/generic/nsBlockFrame.cpp, line 3840

Thread 0 Crashed:
0   nsIFrame::GetStyleDisplay() const + 15 (nsStyleStructList.h:95)
1   nsLineBox::nsLineBox[in-charge](nsIFrame*, int, int) + 223 (nsLineBox.cpp:70)
2   NS_NewLineBox(nsIPresShell*, nsIFrame*, int, int) + 66 (nsLineBox.cpp:94)
3   nsBlockReflowState::NewLineBox(nsIFrame*, int, int) + 51 (nsBlockReflowState.cpp:191)
4   nsBlockFrame::SplitLine(nsBlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) + 681 (nsBlockFrame.cpp:3843)
...

Comment 1

[Bernd]

This does not crash anymore with current trunk however it spills a lot of warnings

WARNING: We shouldn't be backing up more than once! Someone must have set a break opportunity beyond the available width, even though there were better break opportunities before it: file d:/moz_src/src/layout/generic/nsBlockFrame.cpp, line 3469

Comment 2

[Jesse Ruderman]

Yep, WFM.  I'll toss the testcase in as a crashtest in a bit.