438266 - "ASSERTION: nsCellMap::InsertRows called with negative rowIndex" with <hr>, -moz-column

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1a1pre) Gecko/2008053113 Minefield/3.1a1pre

###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file layout/generic/nsBlockFrame.cpp, line 1403

###!!! ASSERTION: nsCellMap::InsertRows called with negative rowIndex: 'aFirstRowIndex >= 0', file layout/tables/nsCellMap.cpp, line 1413

###!!! ASSERTION: Why are we calling this?: 'aNumRows >= 1', file layout/tables/nsCellMap.cpp, line 1384

###!!! ASSERTION: Attempting to allocate excessively large array: 'Error', file nsTArray.cpp, line 69

In order to trigger the bug, the width of the <hr> has to be larger than the width of the browser window.  (It is 7000px in the attached testcase.)

CCing dveditz based on bug 344000 comment 4.

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

I've seen [sg:critical?] crashes with testcases that seem related.

Comment 3

[Bernd]

The first assert indicates that the root is a block reflow bug. Usually it requires some heavy trading with robert to get those fixed ;-) (see bug 428263)

Comment 4

[Jesse Ruderman]

WFM.  I'll add a crashtest.

Comment 5

[Jesse Ruderman]

Crashtest added:

http://hg.mozilla.org/mozilla-central/rev/aad5b1c64ed4