734777 - "ASSERTION: value should always be stored and non-empty when state set"

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: value should always be stored and non-empty when state set: 'prop && !prop->mLines.empty() && prop->mLines.front()->mFirstChild == prop->mFrames.FirstChild()', file layout/generic/nsBlockFrame.cpp, line 4592

Might be a regression from bug 728908.

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Mats Palmgren (inactive)]

The assertion is a bit of a false alarm, the code functions correctly.
What happens is nsBlockFrame::PullFrameFrom pulls the only frame from
an overflow line.  On line 2659 we remove it from the corresponding
frame list (which becomes empty), then we call RemoveOverflowLines()
on line 2690, triggering the assertion.

Comment 3

[Mats Palmgren (inactive)]

http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsBlockFrame.cpp#2648

Comment 4

[Mats Palmgren (inactive)]

Attachment: wip

This is one solution.  I don't want to do to much work on a line we're
about to delete anyway, but --mChildCount shouldn't be to expensive.

It's 2.30am here so I'm going to sleep on it before asking for review.
Let me know if you have a better idea.

Comment 5

[Mats Palmgren (inactive)]

Attachment: fix

The attached test doesn't trigger the assertion anymore for some
reason, but layout/generic/crashtests/520340.html does.

Comment 6

[Mats Palmgren (inactive)]

https://tbpl.mozilla.org/?tree=Try&rev=d397f45aac6e

Comment 7

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/387349ed9abf

Comment 8

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/387349ed9abf