Closed Bug 564968 Opened 14 years ago Closed 14 years ago

Crash [@ nsOverflowContinuationTracker::SetUpListWalker] with -moz-column

Categories

(Core :: Layout, defect, P2)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla1.9.3a5
Tracking Flags:
Tracking Status
blocking2.0 --- final+
status1.9.2 --- unaffected
status1.9.1 --- unaffected

People

(Reporter: jruderman, Assigned: MatsPalmgren_bugz)

References

Details

(4 keywords)

Crash Data

Attachments

(5 files)

testcase (crashes Firefox when loaded)
766 bytes, application/xhtml+xml
Details
crash info
7.44 KB, text/plain
Details
frame dump + trace
9.58 KB, text/html
Details
wip1
3.87 KB, patch
fantasai.bugs
: review+
Details | Diff | Splinter Review
wip1, with nit fixed (landed)
4.74 KB, patch
Details | Diff | Splinter Review 
###!!! ASSERTION: Expected out-of-flow frame: 'aDeletedFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW', file layout/generic/nsBlockFrame.cpp, line 5159

###!!! ASSERTION: Destroying float without removing from a child list.: 'Error', file layout/generic/nsBlockFrame.cpp, line 4835

Crash [@ nsOverflowContinuationTracker::SetUpListWalker]

Based on layout/reftests/bugs/379349-2b.xhtml.
Attached file crash info — 

    
    

    
  
Bisecting fingered bug 492627.
Blocks: 492627
blocking2.0: --- → ?

    
    

    
  

      
      
      
      

        Attached file
          
        frame dump + trace
        — 
      

    


  
The bug is in DoRemoveFrame; we're calling it with aDeletedFrame=0x1721b80
(cyan), iterating the lines we find it and its next-in-flow 0x17414b8 (blue)
and destroy them, then exit the loop and recurse DoRemoveFrame with
0x17430a0 (red) which is an overflow container, which now doesn't have a
prev-in-flow anymore since we just destroyed them, hence the assertion
and crash...
Assignee: nobody → matspal

    
  
OS: Mac OS X → All
Hardware: x86 → All

    
    

    
  

      
      
      
      

        Attached patch
          
          
        wip1
        — 
          — Splinter Review
      

    


  
There is a check for overflow container next-in-flows before the loop,
I think we should just move it inside the loop.

    
  

        Attachment #447453 -
        Flags: review?(fantasai.bugs)

    
  

          status1.9.1:
          --- → unaffected

          status1.9.2:
          --- → unaffected
Keywords: regression
blocking2.0: ? → final+
Priority: -- → P2

    
    

    
  
Comment on attachment 447453 [details] [diff] [review]
wip1

Seems pretty reasonable to me. Use presContext() instead of calling ->PresContext(), though.

        Attachment #447453 -
        Flags: review?(fantasai.bugs) → review+

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/ffcb26b63cfc
Status: NEW → RESOLVED
Closed: 14 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.3a5
Crash Signature: [@ nsOverflowContinuationTracker::SetUpListWalker]

          You need to log in
          before you can comment on or make changes to this bug.