Closed Bug 564968 Opened 10 years ago Closed 9 years ago

Crash [@ nsOverflowContinuationTracker::SetUpListWalker] with -moz-column

Categories

(Core :: Layout, defect, P2, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla1.9.3a5
Tracking Status
blocking2.0 --- final+
status1.9.2 --- unaffected
status1.9.1 --- unaffected

People

(Reporter: jruderman, Assigned: mats)

References

(Blocks 1 open bug)

Details

(4 keywords)

Crash Data

Attachments

(5 files)

###!!! ASSERTION: Expected out-of-flow frame: 'aDeletedFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW', file layout/generic/nsBlockFrame.cpp, line 5159

###!!! ASSERTION: Destroying float without removing from a child list.: 'Error', file layout/generic/nsBlockFrame.cpp, line 4835

Crash [@ nsOverflowContinuationTracker::SetUpListWalker]

Based on layout/reftests/bugs/379349-2b.xhtml.
Attached file crash info
Bisecting fingered bug 492627.
Blocks: 492627
blocking2.0: --- → ?
Attached file frame dump + trace
The bug is in DoRemoveFrame; we're calling it with aDeletedFrame=0x1721b80
(cyan), iterating the lines we find it and its next-in-flow 0x17414b8 (blue)
and destroy them, then exit the loop and recurse DoRemoveFrame with
0x17430a0 (red) which is an overflow container, which now doesn't have a
prev-in-flow anymore since we just destroyed them, hence the assertion
and crash...
Assignee: nobody → matspal
OS: Mac OS X → All
Hardware: x86 → All
Attached patch wip1Splinter Review
There is a check for overflow container next-in-flows before the loop,
I think we should just move it inside the loop.
Attachment #447453 - Flags: review?(fantasai.bugs)
blocking2.0: ? → final+
Priority: -- → P2
Comment on attachment 447453 [details] [diff] [review]
wip1

Seems pretty reasonable to me. Use presContext() instead of calling ->PresContext(), though.
Attachment #447453 - Flags: review?(fantasai.bugs) → review+
http://hg.mozilla.org/mozilla-central/rev/ffcb26b63cfc
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9.3a5
Crash Signature: [@ nsOverflowContinuationTracker::SetUpListWalker]
You need to log in before you can comment on or make changes to this bug.