Closed Bug 474075 Opened 14 years ago Closed 14 years ago

"ASSERTION: Dead placeholder in placeholder map" with -moz-column, float, fixed pos

Categories

(Core :: Layout, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: roc)

References

Details

(Keywords: assertion, crash, testcase, Whiteboard: [sg:critical?])

Attachments

(1 file)

Attached file testcase
###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file layout/generic/nsPlaceholderFrame.cpp, line 132

###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file layout/base/nsFrameManager.cpp, line 137

###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file layout/generic/nsHTMLReflowState.cpp, line 1130

Crash: null deref [@ nsHTMLReflowState::GetHypotheticalBoxContainer]
Whiteboard: [sg:critical?]
Depends on: 463350
(In reply to comment #0)
> ###!!! ASSERTION: Placeholder relationship should have been torn down; see
> comments in nsPlaceholderFrame.h:
> '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file
> layout/generic/nsPlaceholderFrame.cpp, line 132

The stack leading to this assertion makes me reasonably confident it's the same problem as bug 463350.
Likely related to bug 493649.
Depends on: 493649
Actually, this is worksforme on tip, even without the fix for bug 493649.  I'll bet it was fixed by the fix for bug 463350, as dbaron thought.
Status: NEW → RESOLVED
Closed: 14 years ago
No longer depends on: 493649
Flags: in-testsuite?
Resolution: --- → FIXED
Group: core-security
crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/94dbffe183bc
Flags: in-testsuite? → in-testsuite+
Assignee: jruderman → roc
You need to log in before you can comment on or make changes to this bug.