621424 - Lots of assertions with -moz-column, float, padding

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: not in child list: 'found', file layout/base/nsLayoutUtils.cpp, line 287

###!!! ASSERTION: Destroying float without removing from a child list.: 'Error', file layout/generic/nsBlockFrame.cpp, line 4926

###!!! ASSERTION: asked to construct a frame for a node that already has a frame: '!child->GetPrimaryFrame() || child->GetPrimaryFrame()->GetContent() != child', file layout/base/nsCSSFrameConstructor.cpp, line 6868

###!!! ASSERTION: asked to create frame construction item for a node that already has a frame: 'Error', file layout/base/nsCSSFrameConstructor.cpp, line 5033

###!!! ASSERTION: no placeholder frame for out-of-flow frame: 'Not Reached', file layout/generic/nsFrame.cpp, line 6431

Comment 1

[Jesse Ruderman]

Attachment: stack traces

Comment 2

[Timothy Nikkel (:tnikkel)]

I wonder if this is worse on 3.6 and earlier where we will actually construct those duplicate primary frames that those assertions complain about.

Comment 3

[Timothy Nikkel (:tnikkel)]

Hmm, we actually don't get any of those asserts on 1.9.2. So this is from something since then.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Regression from bug 563584, perhaps?

Comment 5

[Timothy Nikkel (:tnikkel)]

Indeed, it is.

Comment 6

[Jesse Ruderman]

Variants produce additional assertions, such as:

###!!! ASSERTION: Style contexts are not in the same style context tree: 'top1 == top2', file layout/base/nsFrameManager.cpp

Comment 7

[Jesse Ruderman]

This is one of the worst fuzz bugs in terms of preventing me from finding other bugs. It causes lots of different assertion failures, including some assertions that can be great at finding a wide variety of bugs when I don't have to ignore them.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I don't see any assertions on the testcase on Linux.  This may mean it's font-size-dependent or something like that, or that I have a patch in my tree that fixes it (if so, probably pretty old).

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

...which would mean, most likely, the patches for bug 588237 that I never finished.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8a7bf5de378d