Closed
Bug 812665
Opened 13 years ago
Closed 13 years ago
"ASSERTION: Think of the children!" with {ib}, abs pos, preserve-3d
Categories
(Core :: Layout, defect)
Core
Layout
Tracking
()
RESOLVED
FIXED
mozilla20
| Tracking | Status | |
|---|---|---|
| firefox16 | --- | unaffected |
| firefox17 | --- | unaffected |
| firefox18 | --- | unaffected |
| firefox19 | + | fixed |
| firefox-esr10 | --- | unaffected |
| firefox-esr17 | --- | unaffected |
People
(Reporter: jruderman, Assigned: MatsPalmgren_bugz)
References
Details
(5 keywords, Whiteboard: [adv-main19-])
Attachments
(4 files)
|
228 bytes,
text/html
|
Details | |
|
18.66 KB,
text/plain
|
Details | |
|
5.01 KB,
text/html
|
Details | |
|
1.29 KB,
patch
|
roc
:
review+
akeybl
:
approval-mozilla-aurora+
|
Details | Diff | Splinter Review |
Load:
###!!! ASSERTION: Think of the children!: '!HasAbsolutelyPositionedChildren()', file layout/generic/nsFrame.cpp, line 266
Unload:
Assertion failure: mPresArenaAllocCount == 0 (Some pres arena objects were not freed), at layout/base/nsPresShell.cpp:769
I'm guessing this is a regression from bug 804323 (like bug 806056).
|
Reporter | |
Comment 1•13 years ago
|
||
|
Assignee | |
Comment 2•13 years ago
|
||
Assignee: nobody → matspal
|
|
Assignee | |
Updated•13 years ago
|
status-firefox-esr10:
--- → unaffected
status-firefox16:
--- → unaffected
status-firefox17:
--- → unaffected
status-firefox18:
--- → unaffected
status-firefox19:
--- → affected
status-firefox-esr17:
--- → unaffected
Flags: in-testsuite?
Keywords: crash
OS: Mac OS X → All
Hardware: x86_64 → All
|
|
Assignee | |
Comment 3•13 years ago
|
||
I think we need to look for placeholders in continuations and special siblings too.
https://tbpl.mozilla.org/?tree=Try&rev=a527b67082b2
Attachment #682802 -
Flags: review?(roc)
Attachment #682802 -
Flags: review?(roc) → review+
|
||
Comment 4•13 years ago
|
||
Nominating for tracking to make sure it gets landed for 19, either before the uplift on central or afterwards on aurora.
tracking-firefox19:
--- → ?
|
|
Assignee | |
Comment 5•13 years ago
|
||
|
||
Comment 6•13 years ago
|
||
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
Comment on attachment 682802 [details] [diff] [review]
fix
[Approval Request Comment]
Bug caused by (feature/regressing bug #): 804323
User impact if declined: Crash in some pages (probably rare)
Testing completed (on m-c, etc.): A couple of days on m-c
Risk to taking this patch (and alternatives if risky): very low risk, it simply makes us take a slow path in a few more cases
String or UUID changes made by this patch: none
Attachment #682802 -
Flags: approval-mozilla-aurora?
|
|
||
Comment 8•13 years ago
|
||
What's the security rating of this bug?
I think it should be high or critical.
Hmm, we should have asked for sec-approval.
|
|
||
Updated•13 years ago
|
Keywords: sec-critical
|
|
||
Updated•13 years ago
|
Attachment #682802 -
Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
|
|
Assignee | |
Comment 10•13 years ago
|
||
|
||
Updated•13 years ago
|
Whiteboard: [adv-main19-]
|
||
Updated•12 years ago
|
Group: core-security
|
|
Assignee | |
Comment 11•12 years ago
|
||
Landed the crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/60f4f19178e7
Flags: in-testsuite? → in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•