Last Comment Bug 695861 - "ASSERTION: Can't find frame in lines!" with -moz-column, "unicode-bidi: -moz-isolate"
: "ASSERTION: Can't find frame in lines!" with -moz-column, "unicode-bidi: -moz...
Status: RESOLVED FIXED
: assertion, testcase
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: All All
: -- critical (vote)
: mozilla10
Assigned To: Simon Montagu :smontagu
:
Mentors:
Depends on:
Blocks: randomstyles 613149
  Show dependency treegraph
 
Reported: 2011-10-19 14:16 PDT by Jesse Ruderman
Modified: 2011-11-03 08:59 PDT (History)
4 users (show)
smontagu: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (asserts fatally when loaded) (356 bytes, text/html)
2011-10-19 14:16 PDT, Jesse Ruderman
no flags Details
stack trace (9.03 KB, text/plain)
2011-10-19 14:17 PDT, Jesse Ruderman
no flags Details
Patch (1.15 KB, patch)
2011-11-01 03:38 PDT, Simon Montagu :smontagu
no flags Details | Diff | Splinter Review
Patch (2.39 KB, patch)
2011-11-01 03:40 PDT, Simon Montagu :smontagu
no flags Details | Diff | Splinter Review
Patch v.2 (2.00 KB, patch)
2011-11-02 16:10 PDT, Simon Montagu :smontagu
roc: review+
smontagu: checkin+
Details | Diff | Splinter Review

Description Jesse Ruderman 2011-10-19 14:16:35 PDT
Created attachment 568194 [details]
testcase (asserts fatally when loaded)

###!!! ASSERTION: Can't find frame in lines!: 'hasNext', file layout/base/nsBidiPresUtils.cpp, line 377

###!!! ABORT: comparing iterators over different lists: 'mListLink == aOther.mListLink', file layout/generic/nsLineBox.h, line 722

This testcase uses a layout feature added recently, in bug 613149.
Comment 1 Jesse Ruderman 2011-10-19 14:17:04 PDT
Created attachment 568195 [details]
stack trace
Comment 2 Simon Montagu :smontagu 2011-11-01 03:38:11 PDT
Created attachment 570953 [details] [diff] [review]
Patch
Comment 3 Simon Montagu :smontagu 2011-11-01 03:40:21 PDT
Created attachment 570955 [details] [diff] [review]
Patch

The real patch this time
Comment 4 Robert O'Callahan (:roc) (email my personal email if necessary) 2011-11-01 19:20:00 PDT
Can you explain what the bug is and why this fixes it?
Comment 5 Simon Montagu :smontagu 2011-11-02 16:10:23 PDT
Created attachment 571496 [details] [diff] [review]
Patch v.2

Putting a description of the bug into words made me realize that there is a simpler fix for it :)

What was happening was that when a bidi continuation in an element with unicode-bidi: -moz-isolate crossed a column break, we were passing the saved mPrevFrame from the previous column in the subparagraph into AdvanceLineIteratorToFrame, even though we had meanwhile created a new nsBlockInFlowLineIterator for the new column.

The new patch zeros out the mPrevFrame in the subparagraph as well as the containing paragraph when creating the new line iterator.
Comment 7 Marco Bonardo [::mak] 2011-11-03 08:59:00 PDT
https://hg.mozilla.org/mozilla-central/rev/3025c93444a6

Note You need to log in before you can comment on or make changes to this bug.