478131 - "ASSERTION: Column set should be complete if the available height is unconstrained"

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (partially reduced)

This testcase triggers the assertion in bug 468771:

###!!! ASSERTION: Column set should be complete if the available height is unconstrained: 'NS_FRAME_IS_COMPLETE(aStatus) || aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /Users/jruderman/central/layout/generic/nsColumnSetFrame.cpp, line 1030

Comment 1

[Jesse Ruderman]

It also triggers:

###!!! ASSERTION: Computed overflow area must contain frame bounds: 'aNewSize.width == 0 || aNewSize.height == 0 || aOverflowArea->Contains(nsRect(nsPoint(0, 0), aNewSize))', file /Users/jruderman/central/layout/generic/nsFrame.cpp, line 5562

###!!! ASSERTION: Shouldn't be incomplete if availableHeight is UNCONSTRAINED.: 'aReflowState.availableHeight != NS_UNCONSTRAINEDSIZE', file /Users/jruderman/central/layout/generic/nsBlockFrame.cpp, line 1390

###!!! ASSERTION: bad height: 'Not Reached', file /Users/jruderman/central/layout/generic/nsLineLayout.cpp, line 188

Comment 2

[Jesse Ruderman]

> This testcase triggers the assertion in bug 468771:

I meant "the assertion ADDED in bug 468771".

Comment 3

[Daniel Veditz [:dveditz]]

roc: is this a real bug or is the assertion wrong? How bad is the problem the assertion is warning about?

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

It's a real bug. The problem does not directly lead to memory safety issues, though.

Comment 5

[Aaron Train [:aaronmt]]

Test URL

http://en.wikipedia.org/wiki/List_of_Naruto_manga_volumes

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

The abort is unrelated to this.

Comment 9

[Jesse Ruderman]

WFM, but see bug 569193.

Comment 10

[Jesse Ruderman]

Crashtest: http://hg.mozilla.org/mozilla-central/rev/e5dd52dd3cb5