564968 - Crash [@ nsOverflowContinuationTracker::SetUpListWalker] with -moz-column

Status: RESOLVED FIXED

(Core :: Layout, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: Expected out-of-flow frame: 'aDeletedFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW', file layout/generic/nsBlockFrame.cpp, line 5159

###!!! ASSERTION: Destroying float without removing from a child list.: 'Error', file layout/generic/nsBlockFrame.cpp, line 4835

Crash [@ nsOverflowContinuationTracker::SetUpListWalker]

Based on layout/reftests/bugs/379349-2b.xhtml.

Comment 1

[Jesse Ruderman]

Attachment: crash info

Comment 2

[Timothy Nikkel (:tnikkel)]

Bisecting fingered bug 492627.

Comment 3

[Mats Palmgren (inactive)]

Attachment: frame dump + trace

The bug is in DoRemoveFrame; we're calling it with aDeletedFrame=0x1721b80
(cyan), iterating the lines we find it and its next-in-flow 0x17414b8 (blue)
and destroy them, then exit the loop and recurse DoRemoveFrame with
0x17430a0 (red) which is an overflow container, which now doesn't have a
prev-in-flow anymore since we just destroyed them, hence the assertion
and crash...

Comment 4

[Mats Palmgren (inactive)]

Attachment: wip1

There is a check for overflow container next-in-flows before the loop,
I think we should just move it inside the loop.

Comment 5

[fantasai]

Comment on attachment 447453 [details] [diff] [review]
wip1

Seems pretty reasonable to me. Use presContext() instead of calling ->PresContext(), though.

Comment 6

[Mats Palmgren (inactive)]

Attachment: wip1, with nit fixed (landed)

Comment 7

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/rev/ffcb26b63cfc