"ASSERTION: Dead placeholder in placeholder map" with -moz-column, float, fixed pos

RESOLVED FIXED

Status

()

defect
--
critical
RESOLVED FIXED
11 years ago
6 years ago

People

(Reporter: jruderman, Assigned: roc)

Tracking

(Blocks 1 bug, {assertion, crash, testcase})

Trunk
x86
macOS
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?])

Attachments

(1 attachment)

Reporter

Description

11 years ago
Posted file testcase
###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file layout/generic/nsPlaceholderFrame.cpp, line 132

###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file layout/base/nsFrameManager.cpp, line 137

###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file layout/generic/nsHTMLReflowState.cpp, line 1130

Crash: null deref [@ nsHTMLReflowState::GetHypotheticalBoxContainer]
Reporter

Updated

11 years ago
Whiteboard: [sg:critical?]
(In reply to comment #0)
> ###!!! ASSERTION: Placeholder relationship should have been torn down; see
> comments in nsPlaceholderFrame.h:
> '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file
> layout/generic/nsPlaceholderFrame.cpp, line 132

The stack leading to this assertion makes me reasonably confident it's the same problem as bug 463350.
Likely related to bug 493649.
Depends on: 493649
Actually, this is worksforme on tip, even without the fix for bug 493649.  I'll bet it was fixed by the fix for bug 463350, as dbaron thought.
Status: NEW → RESOLVED
Closed: 10 years ago
No longer depends on: 493649
Flags: in-testsuite?
Resolution: --- → FIXED
Group: core-security
crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/94dbffe183bc
Flags: in-testsuite? → in-testsuite+
Assignee: jruderman → roc
You need to log in before you can comment on or make changes to this bug.