Created attachment 376521 [details] testcase ###!!! ASSERTION: no pseudo elements in undisplayed map: 'Not Reached', file /Users/jruderman/central/layout/base/nsFrameManager.cpp, line 1303
Hmm. This is similar to bug 492112, but the assertion here seems a lot more reasonable... I'll think about how to fix.
9 years ago
Most simply would be to not put the content for items with mIsGeneratedContent true into the undisplayed map. Or to not do so for cases when the style context of the item has a pseudo, maybe.
Created attachment 377319 [details] [diff] [review] Proposed fix
Did you look up the CVS history for why there was the mozNonElement check there?
The relevant CVS checkin comment is: Fix 2 cases where ReResolveStyleContext was broken, causing serious problems with dynamic style reresolution. Change nsIFrame::GetStyleContextProvider to GetParentStyleContextFrame, always use its result rather than using the parent frame in some cases, and move a bit of the complexity into the GetParentStyleContextFrame implementations. Fix block-within-inline case (bug 129350) using a special-previous-sibling frame property and ensuring that NS_FRAME_IS_SPECIAL is copied when frames are split. Fix out-of-flow frame case (bug 88154) by going to the placeholder map and by parenting the placeholder frame style contexts to the style context from their frame parent rather than the out-of-flow frame. b=129350 r=attinasi sr=hyatt a=asa This is rev 1.110 of nsFrameManager.cpp. But fundamentally, as long as the non-element styles can't be display:none while the parent content is not display:none, we just can't end up with non-elements in the undisplayed content map... I think the code was there by analogy with the other place in ReResolveStyleContext, where we look at child frames and reresolve them; there of course we do need to deal with the non-element case.
Pushed http://hg.mozilla.org/mozilla-central/rev/ae03e9085759 with a crashtest.