701504 - "ASSERTION: Can't find frame in lines!" with -moz-column, -moz-isolate, rtl

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

###!!! ASSERTION: Can't find frame in lines!: 'hasNext', file layout/base/nsBidiPresUtils.cpp, line 377

###!!! ABORT: comparing iterators over different lists: 'mListLink == aOther.mListLink', file layout/generic/nsLineBox.h, line 722

Similar symptoms to bug 695861, which smontagu fixed last week.

Comment 1

[Jesse Ruderman]

Attachment: stack traces

Comment 2

[Jesse Ruderman]

Now fails with a different abort:

###!!! ASSERTION: Can't find frame in lines!: 'hasNext', file layout/base/nsBidiPresUtils.cpp, line 317

###!!! ABORT: running past end: 'mCurrent != mListLink', file nsLineBox.h, line 681

Comment 3

[Mats Palmgren (inactive)]

Attachment: frame dump

We're calling AdvanceLineIteratorToFrame with aPrevFrame that's in a different
block than the line iterator container.

Comment 4

[Mats Palmgren (inactive)]

Attachment: fix+test

Trivial fix, but note also how this avoids calling bpd.GetSubParagraph()
which allocates it if it didn't exist.  AFAICT, that's unnecessary.

Comment 5

[Mats Palmgren (inactive)]

https://tbpl.mozilla.org/?tree=Try&rev=e70bb0d805d3

Comment 6

[Simon Montagu :smontagu]

Comment on attachment 733314 [details] [diff] [review]
fix+test

Review of attachment 733314 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

Comment 7

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a827177c136e

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a827177c136e