826978 - Crash with rel&abs pos, MathML, with "ASSERTION: FloatManager should be set in nsBlockReflowState: 'mFloatManager'"

Status: RESOLVED DUPLICATE of bug 1373767

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: FloatManager should be set in nsBlockReflowState: 'mFloatManager', file layout/generic/nsBlockReflowState.cpp, line 70

Crash [@ nsFloatManager::ClearFloats]
Nightly: bp-c44c79c8-ba64-42f7-97db-013672130105

Comment 1

[Jesse Ruderman]

Attachment: stacks

Comment 2

[Scoobidiver (away)]

On Windows: bp-cbfd8b3d-fff7-4112-8fab-cdf2f2130106.

Comment 3

[Daniel Holbert [:dholbert]]

Last good nightly: 2012-03-11
First bad nightly: 2012-03-12

Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6737b6762eb8&tochange=5ec9524de1af

Comment 4

[Daniel Holbert [:dholbert]]

Inbound regression range:

Last good nightly: 2012-03-10
First bad nightly: 2012-03-11

Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=9e3fc01c33bc&tochange=5f8a4ddce900
...which contains:
> d069fd0abc23	Daniel Holbert — Bug 640443: Allow positioned display:-moz-box elements to be containers for absolutely-positioned content. r=bz

That seems likely to be related.

Comment 5

[Daniel Holbert [:dholbert]]

Nope, targeted builds revealed that this actually regressed in the cset after that one -- specifically, this is the first cset that crashes:
> 50ebad2e58ba	Daniel Holbert — Bug 733875: If you're a nsFrame inside a box, be sure to reflow your absolute children after box layout gives you your size. r=bz

Comment 9

[Daniel Holbert [:dholbert]]

Testcase doesn't crash anymore. Fix range:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c6a2643362a67cdf7a87ac165454fce4b383debb&tochange=f78d5947333422ab09ec23e3dab0d48538c9d6ad

In that range, this would've been a dupe of bug 1373767. Marking as such.

This bug does also have a crash signature associated which has one hit from the past 6 months, nsFloatManager::ClearFloats. That crash report is
bp-815f34b8-105d-46d7-b94d-d62510220428 and was from Firefox 99.0.1 in April, with no MathML in the backtrace, so likely unrelated to the original testcase here.

We can file a new bug for that crash signature if it starts getting hit again, in any case.