Closed Bug 734777 Opened 13 years ago Closed 12 years ago

"ASSERTION: value should always be stored and non-empty when state set"

Categories

(Core :: Layout, defect)

defect
Not set
trivial

Tracking

()

RESOLVED FIXED
mozilla20

People

(Reporter: jruderman, Assigned: MatsPalmgren_bugz)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(3 files, 1 obsolete file)

Attached file testcase
###!!! ASSERTION: value should always be stored and non-empty when state set: 'prop && !prop->mLines.empty() && prop->mLines.front()->mFirstChild == prop->mFrames.FirstChild()', file layout/generic/nsBlockFrame.cpp, line 4592 Might be a regression from bug 728908.
Attached file stack trace
The assertion is a bit of a false alarm, the code functions correctly. What happens is nsBlockFrame::PullFrameFrom pulls the only frame from an overflow line. On line 2659 we remove it from the corresponding frame list (which becomes empty), then we call RemoveOverflowLines() on line 2690, triggering the assertion.
Assignee: nobody → matspal
OS: Mac OS X → All
Hardware: x86_64 → All
Attached patch wip (obsolete) — Splinter Review
This is one solution. I don't want to do to much work on a line we're about to delete anyway, but --mChildCount shouldn't be to expensive. It's 2.30am here so I'm going to sleep on it before asking for review. Let me know if you have a better idea.
Attached patch fixSplinter Review
The attached test doesn't trigger the assertion anymore for some reason, but layout/generic/crashtests/520340.html does.
Attachment #604813 - Attachment is obsolete: true
Attachment #696118 - Flags: review?(roc)
Severity: normal → trivial
Flags: in-testsuite+
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: