474075 - "ASSERTION: Dead placeholder in placeholder map" with -moz-column, float, fixed pos

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Placeholder relationship should have been torn down; see comments in nsPlaceholderFrame.h: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file layout/generic/nsPlaceholderFrame.cpp, line 132

###!!! ASSERTION: Dead placeholder in placeholder map: 'entry->placeholderFrame->GetOutOfFlowFrame() != (void*)0xdddddddd', file layout/base/nsFrameManager.cpp, line 137

###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file layout/generic/nsHTMLReflowState.cpp, line 1130

Crash: null deref [@ nsHTMLReflowState::GetHypotheticalBoxContainer]

Comment 1

[David Baron :dbaron:]

(In reply to comment #0)
> ###!!! ASSERTION: Placeholder relationship should have been torn down; see
> comments in nsPlaceholderFrame.h:
> '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file
> layout/generic/nsPlaceholderFrame.cpp, line 132

The stack leading to this assertion makes me reasonably confident it's the same problem as bug 463350.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Likely related to bug 493649.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Actually, this is worksforme on tip, even without the fix for bug 493649.  I'll bet it was fixed by the fix for bug 463350, as dbaron thought.

Comment 4

[Mats Palmgren (inactive)]

crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/94dbffe183bc

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/94dbffe183bc