457380 - "ASSERTION: existing overflow list" with moz-column, :before, frameset

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: Someone didn't override Reflow or ComputeAutoSize: 'Not Reached', file /Users/jruderman/central/layout/generic/nsLeafFrame.cpp, line 131

###!!! ASSERTION: reflow roots should never split: 'status == NS_FRAME_COMPLETE', file /Users/jruderman/central/layout/base/nsPresShell.cpp, line 6306

###!!! ASSERTION: existing overflow list: 'rv != NS_PROPTABLE_PROP_OVERWRITTEN', file /Users/jruderman/central/layout/generic/nsContainerFrame.cpp, line 1193

Bug 414321 triggers the first assertion and bug 430569 triggers the second assertion, but I don't know of any other bugs on the third assertion.

Gary Kwong found this bug and I helped reduce the testcase.

Comment 1

[Boris Zbarsky [:bzbarsky]]

We're calling SetOverflowFrames on an nsCanvasFrame from CanvasFrame::Reflow.  But I bet nsCanvasFrame only handles getting overflow frames and doing something with them when printing, so we can end up clobbering them...

I wonder whether this can cause us to leak the overflowing frames.

Comment 2

[Jesse Ruderman]

WFM.  I'll add a crashtest.

Comment 3

[Jesse Ruderman]

Added crashtest:
http://hg.mozilla.org/mozilla-central/rev/63120a5301f2