Closed Bug 621424 Opened 9 years ago Closed 7 years ago
Lots of assertions with -moz-column, float, padding
###!!! ASSERTION: not in child list: 'found', file layout/base/nsLayoutUtils.cpp, line 287 ###!!! ASSERTION: Destroying float without removing from a child list.: 'Error', file layout/generic/nsBlockFrame.cpp, line 4926 ###!!! ASSERTION: asked to construct a frame for a node that already has a frame: '!child->GetPrimaryFrame() || child->GetPrimaryFrame()->GetContent() != child', file layout/base/nsCSSFrameConstructor.cpp, line 6868 ###!!! ASSERTION: asked to create frame construction item for a node that already has a frame: 'Error', file layout/base/nsCSSFrameConstructor.cpp, line 5033 ###!!! ASSERTION: no placeholder frame for out-of-flow frame: 'Not Reached', file layout/generic/nsFrame.cpp, line 6431
I wonder if this is worse on 3.6 and earlier where we will actually construct those duplicate primary frames that those assertions complain about.
Hmm, we actually don't get any of those asserts on 1.9.2. So this is from something since then.
Regression from bug 563584, perhaps?
Indeed, it is.
Variants produce additional assertions, such as: ###!!! ASSERTION: Style contexts are not in the same style context tree: 'top1 == top2', file layout/base/nsFrameManager.cpp
This is one of the worst fuzz bugs in terms of preventing me from finding other bugs. It causes lots of different assertion failures, including some assertions that can be great at finding a wide variety of bugs when I don't have to ignore them.
I don't see any assertions on the testcase on Linux. This may mean it's font-size-dependent or something like that, or that I have a patch in my tree that fixes it (if so, probably pretty old).
...which would mean, most likely, the patches for bug 588237 that I never finished.
Depends on: 588237
Assignee: nobody → dbaron
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.