Closed Bug 826978 Opened 12 years ago Closed 2 years ago

Crash with rel&abs pos, MathML, with "ASSERTION: FloatManager should be set in nsBlockReflowState: 'mFloatManager'"

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1373767

People

(Reporter: jruderman, Unassigned)

References

Details

(4 keywords)

Crash Data

Attachments

(2 files)

testcase (crashes Firefox when loaded)
220 bytes, text/html
Details
stacks
20.31 KB, text/plain
Details 
###!!! ASSERTION: FloatManager should be set in nsBlockReflowState: 'mFloatManager', file layout/generic/nsBlockReflowState.cpp, line 70

Crash [@ nsFloatManager::ClearFloats]
Nightly: bp-c44c79c8-ba64-42f7-97db-013672130105
Attached file stacks — 

    
    

    
  
On Windows: bp-cbfd8b3d-fff7-4112-8fab-cdf2f2130106.
Crash Signature: [@ nsFloatManager::ClearFloats(int, unsigned char, unsigned int) const]
[@ nsFloatManager::ClearFloats(int, unsigned char, unsigned int)]
OS: Mac OS X → All
Hardware: x86_64 → All

    
    

    
  
Last good nightly: 2012-03-11
First bad nightly: 2012-03-12

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6737b6762eb8&tochange=5ec9524de1af
Keywords: regression

    
    

    
  
Inbound regression range:

Last good nightly: 2012-03-10
First bad nightly: 2012-03-11

Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=9e3fc01c33bc&tochange=5f8a4ddce900
...which contains:
> d069fd0abc23	Daniel Holbert — Bug 640443: Allow positioned display:-moz-box elements to be containers for absolutely-positioned content. r=bz

That seems likely to be related.

    
    

    
  
Nope, targeted builds revealed that this actually regressed in the cset after that one -- specifically, this is the first cset that crashes:
> 50ebad2e58ba	Daniel Holbert — Bug 733875: If you're a nsFrame inside a box, be sure to reflow your absolute children after box layout gives you your size. r=bz
Blocks: 733875
Summary: Crash with rel&abs pos, MathML → Crash with rel&abs pos, MathML, with "ASSERTION: FloatManager should be set in nsBlockReflowState: 'mFloatManager'"

    
    

    
      
  

    
    

    
      
  

    
  
Crash Signature: [@ nsFloatManager::ClearFloats(int, unsigned char, unsigned int) const]
[@ nsFloatManager::ClearFloats(int, unsigned char, unsigned int)] → [@ nsFloatManager::ClearFloats(int, unsigned char, unsigned int) const]
[@ nsFloatManager::ClearFloats(int, unsigned char, unsigned int)]
[@ nsFloatManager::ClearFloats const]
[@ nsFloatManager::ClearFloats]

    
  
Severity: critical → S2

    
    

    
  
Testcase doesn't crash anymore. Fix range:

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c6a2643362a67cdf7a87ac165454fce4b383debb&tochange=f78d5947333422ab09ec23e3dab0d48538c9d6ad


In that range, this would've been a dupe of bug 1373767. Marking as such.


This bug does also have a crash signature associated which has one hit from the past 6 months, nsFloatManager::ClearFloats.  That crash report is

bp-815f34b8-105d-46d7-b94d-d62510220428 and was from Firefox 99.0.1 in April, with no MathML in the backtrace, so likely unrelated to the original testcase here.


We can file a new bug for that crash signature if it starts getting hit again, in any case.


Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → DUPLICATE

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: