Closed Bug 682649 Opened 9 years ago Closed 9 years ago

Crash with rel&abs pos, -moz-column

Categories

(Core :: Layout, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 683702

People

(Reporter: jruderman, Assigned: dholbert)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(2 files)

Crashes accessing null or the poison frame address.

Opt stack trace: bp-1f303154-f349-4ea0-bc65-382762110827
Blocks: 369230
Attached file stack trace
Regression window: 2011-08-25-03-08-23 -- 2011-08-26-03-08-05
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e58e98a89827&tochange=e87454393401
Backing out bug 679933 locally makes it not crash on the testcase.
Blocks: 679933
Keywords: regression
https://crash-stats.mozilla.com/report/index/8cfbab78-cb3a-4967-9e72-d93b52110829
0 	xul.dll 	nsFrame::DestroyFrom 	
1 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:344
2 	xul.dll 	nsBlockFrame::DestroyFrom 	layout/generic/nsBlockFrame.cpp:322
3 	xul.dll 	nsIFrame::Destroy 	layout/generic/nsIFrame.h:569
4 	xul.dll 	nsBlockFrame::RemoveFrame 	layout/generic/nsBlockFrame.cpp:5017
5 	xul.dll 	nsPlaceholderFrame::DestroyFrom 	layout/generic/nsPlaceholderFrame.cpp:169
6 	xul.dll 	nsIFrame::Destroy 	layout/generic/nsIFrame.h:569
7 	xul.dll 	nsBlockFrame::DoRemoveFrame 	layout/generic/nsBlockFrame.cpp:5442
8 	xul.dll 	nsBlockFrame::RemoveFrame 	layout/generic/nsBlockFrame.cpp:5011
9 	xul.dll 	nsCSSFrameConstructor::ContentRemoved 	layout/base/nsCSSFrameConstructor.cpp:7516
10 	xul.dll 	nsCSSFrameConstructor::RecreateFramesForContent 	layout/base/nsCSSFrameConstructor.cpp:9091
11 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	layout/base/nsCSSFrameConstructor.cpp:7966
12 	xul.dll 	mozilla::css::RestyleTracker::ProcessRestyles 	layout/base/RestyleTracker.cpp:240
13 	xul.dll 	nsCSSFrameConstructor::ProcessPendingRestyles 	layout/base/nsCSSFrameConstructor.cpp:11622
14 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4760
15 	xul.dll 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6324
16 	xul.dll 	nsGenericElement::GetPrimaryFrame 	content/base/src/nsGenericElement.cpp:3668
17 	xul.dll 	nsGenericElement::GetStyledFrame 	content/base/src/nsGenericElement.cpp:1764
18 	xul.dll 	nsGenericHTMLElement::GetOffsetRect 	content/html/content/src/nsGenericHTMLElement.cpp:506
19 	xul.dll 	nsGenericHTMLElement::GetOffsetHeight 	content/html/content/src/nsGenericHTMLElement.cpp:649
20 	xul.dll 	nsIDOMNSHTMLElement_GetOffsetHeight 	obj-firefox/js/src/xpconnect/src/dom_quickstubs.cpp:22608
etc..
(In reply to Mats Palmgren [:mats] from comment #2)
> Regression window: 2011-08-25-03-08-23 -- 2011-08-26-03-08-05
> http://hg.mozilla.org/mozilla-central/
> pushloghtml?fromchange=e58e98a89827&tochange=e87454393401
> Backing out bug 679933 locally makes it not crash on the testcase.

See bug 683702 comment 3.  This is likely the same thing I describe there.  Setting dependency for now. (these bugs are likely dupes, though.)
Depends on: 683702
Confirmed locally that my fix on bug 683702 fixes this. That fix (including a crashtest for this bug here) are both on mozilla-inbound now.

Resolving as dupe.  (Sorry for ascending-bug-number dupe-directionality -- I saw the other bug first, and started commenting on it / spinning up a fix on that bug before noticing this one.)
Assignee: nobody → dholbert
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: in-testsuite+
Resolution: --- → DUPLICATE
Duplicate of bug: 683702
You need to log in before you can comment on or make changes to this bug.