655462 - "ASSERTION: aPrevFrame must be the last continuation in its chain!" with columns, abs pos

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: aPrevFrame must be the last continuation in its chain!: '!aPrevFrame || (!aPrevFrame->GetNextContinuation() || IS_TRUE_OVERFLOW_CONTAINER(aPrevFrame->GetNextContinuation())) && !IS_TRUE_OVERFLOW_CONTAINER(aPrevFrame)', file layout/base/nsFrameManager.cpp, line 499

Might be a regression from today's cedar merge:
http://hg.mozilla.org/mozilla-central/pushloghtml?changeset=62941612320d

Comment 1

[Jesse Ruderman]

Attachment: stack trace (mac debug)

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

tracking-, since even *if* this were a sign of worse problems to come, they'd be problems that would be mitigated by frame poisoning.

Also, what do you mean by "Might be a regression"?

Comment 3

[Jesse Ruderman]

> tracking-, since even *if* this were a sign of worse problems to come, they'd 
> be problems that would be mitigated by frame poisoning.

And web sites don't use columns with abs pos, so this shouldn't be a stability problem. Fair enough.

> Also, what do you mean by "Might be a regression"?

I got several reports from the fuzzer soon after the merge, which makes me think it's not a long-standing bug.

Comment 4

[Timothy Nikkel (:tnikkel)]

Caused by part 1/2 of bug 10209 (14fe8a6cfd45 or b5c0b85194d6).

Ehsan, hopefully one of your followup patches fixes this.

Comment 5

[(no longer active)]

My followup patches do seem to fix this.

Comment 6

[(no longer active)]

Attachment: Crashtest

The crash has been fixed.  Here's the crashtest.

Comment 7

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/98bb04b061d2