Closed Bug 474075 Opened 16 years ago Closed 16 years ago

"ASSERTION: Dead placeholder in placeholder map" with -moz-column, float, fixed pos

Categories

(Core :: Layout, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: roc)

References

Details

(Keywords: assertion, crash, testcase, Whiteboard: [sg:critical?])

Attachments

(1 file)

Attached file testcase
###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file layout/generic/nsPlaceholderFrame.cpp, line 132 ###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file layout/base/nsFrameManager.cpp, line 137 ###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file layout/generic/nsHTMLReflowState.cpp, line 1130 Crash: null deref [@ nsHTMLReflowState::GetHypotheticalBoxContainer]
Whiteboard: [sg:critical?]
(In reply to comment #0) > ###!!! ASSERTION: Placeholder relationship should have been torn down; see > comments in nsPlaceholderFrame.h: > '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file > layout/generic/nsPlaceholderFrame.cpp, line 132 The stack leading to this assertion makes me reasonably confident it's the same problem as bug 463350.
Likely related to bug 493649.
Depends on: 493649
Actually, this is worksforme on tip, even without the fix for bug 493649. I'll bet it was fixed by the fix for bug 463350, as dbaron thought.
Status: NEW → RESOLVED
Closed: 16 years ago
No longer depends on: 493649
Flags: in-testsuite?
Resolution: --- → FIXED
Group: core-security
Flags: in-testsuite? → in-testsuite+
Assignee: jruderman → roc
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: