If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Crash with -moz-column, float, changing text

RESOLVED WORKSFORME

Status

()

Core
Layout
--
critical
RESOLVED WORKSFORME
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: Jesse Ruderman)

Tracking

(Blocks: 2 bugs, {assertion, crash, testcase})

Trunk
x86_64
Mac OS X
assertion, crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Assignee)

Description

5 years ago
Created attachment 713173 [details]
testcase (crashes Firefox when loaded)

###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../layout/base/nsLayoutUtils.cpp, line 4808

###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../layout/generic/nsFrame.cpp, line 633

###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../layout/base/../generic/nsPlaceholderFrame.h, line 162

This might just be another symptom of bug 600100.
(Assignee)

Comment 1

5 years ago
Created attachment 713174 [details]
stack

Updated

5 years ago
Crash Signature: [@ nsLayoutUtils::AssertTreeOnlyEmptyNextInFlows(nsIFrame*)]

Comment 2

5 years ago
FYI
The testcase attachment 713173 [details] crashes. (see Bug 772320 Comment#12 and regressed by Bug 751012)
(Assignee)

Updated

5 years ago
Attachment #713173 - Attachment description: testcase → testcase (crashes Firefox when loaded)
Testcase works for me in a local m-c debug build on Linux64,
without any assertions, and also works in an ASan build.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e636b91b1cbb
Flags: in-testsuite? → in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/e636b91b1cbb
Assignee: nobody → jruderman
You need to log in before you can comment on or make changes to this bug.