Closed Bug 486428 Opened 13 years ago Closed 13 years ago

Crash [@ InlineBackgroundData::GetNextContinuation] with -moz-column, float

Categories

(Core :: Layout, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, testcase, Whiteboard: [sg:critical?])

Crash Data

Attachments

(2 files)

No description provided.
###!!! ASSERTION: frame was not removed from primary frame map before destruction or was readded to map after being removed: 'Not Reached', file /Users/jruderman/central/layout/base/nsFrameManager.cpp, line 732

+ touches 0xddddddf5
Whiteboard: [sg:critical?]
(In reply to comment #1)
> ###!!! ASSERTION: frame was not removed from primary frame map before
> destruction or was readded to map after being removed: 'Not Reached', file
> /Users/jruderman/central/layout/base/nsFrameManager.cpp, line 732

The stack for this assertion makes it look like another duplicate of bug 463350.  (It goes through DeleteNextInFlowChild.)  However, the first testcase seems like it could be different.
Depends on: 463350
WFM on mozilla-central.  No assertions, no crashes.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Crash Signature: [@ InlineBackgroundData::GetNextContinuation]
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.