772306 - Crash with MathML, -moz-column, float

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../layout/base/nsLayoutUtils.cpp, line 4413

###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../layout/base/nsLayoutUtils.cpp, line 4413

###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../layout/generic/nsFrame.cpp, line 594

###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../layout/base/../generic/nsPlaceholderFrame.h, line 167

Crash [@ PresShell::FrameNeedsReflow]

Might be related to bug 757413.

Comment 1

[Jesse Ruderman]

Attachment: stack traces

Comment 2

[Alice0775 White]

Good:
http://hg.mozilla.org/mozilla-central/rev/373d1b393f28
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b4pre) Gecko/20100805 Minefield/4.0b4pre ID:20100805200154
Crash:
http://hg.mozilla.org/mozilla-central/rev/8ab7ef79b673
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b4pre) Gecko/20100805 Minefield/4.0b4pre ID:20100805224228
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=373d1b393f28&tochange=8ab7ef79b673

Supected: Bug 563584

Comment 3

[Scoobidiver (away)]

On Windows: bp-7c55f4df-3c6f-4ba3-9981-a975f2120710.

Comment 4

[Jesse Ruderman]

WFM

Comment 5

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/011c247fc28e

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/011c247fc28e