"ASSERTION: unexpected flow" remains from bug 429969 testcase

RESOLVED WORKSFORME

Status

()

Core
Layout
RESOLVED WORKSFORME
9 years ago
8 years ago

People

(Reporter: dveditz, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

Trunk
x86
Mac OS X
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

9 years ago
+++ This bug was initially created as a clone of Bug #429969 +++

The crash in bug 429969 has been fixed, but attachment 316745 [details] still results in

###!!! ASSERTION: unexpected flow: 'mFrames.ContainsFrame(nextInFlow)', file /Users/jruderman/trunk/mozilla/layout/generic/nsInlineFrame.cpp, line 469

Is this still evidence of a security problem? In addition to bug 429969 this assertion also featured in sg:critical bug 402380
I don't see that assertion on trunk. Did you intend to file this against 1.9.1 and/or 1.9.0?
(Reporter)

Comment 2

9 years ago
in bug 429969 comment 6 Clint said he saw it on both 1.9.1 and 1.9.2, at least on a Mac -- although that _was_ a month ago. Did something fix it meanwhile?

ctalbert: would you mind retesting and see if this has gone away for you? It's possible there's some machine/config difference between you and smontagu, and also possible it's been fixed.
I haven't checked with this testcase, but the same assertion in bug 472950 comment 6 went away with the checkin for bug 332655. I'd like to get bug 332655 into 1.9.1 anyway, as soon as I'm sure there are no more regressions from it.

Comment 4

8 years ago
WFM, 0 assertions now on Mac.

Bug 429969 is already public and in-testsuite+.
Group: core-security
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Flags: in-testsuite+
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.