Closed Bug 840787 Opened 11 years ago Closed 11 years ago
Crash with -moz-column, float, changing text
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../layout/base/nsLayoutUtils.cpp, line 4808 ###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../layout/generic/nsFrame.cpp, line 633 ###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../layout/base/../generic/nsPlaceholderFrame.h, line 162 This might just be another symptom of bug 600100.
Crash Signature: [@ nsLayoutUtils::AssertTreeOnlyEmptyNextInFlows(nsIFrame*)]
FYI The testcase attachment 713173 [details] crashes. (see Bug 772320 Comment#12 and regressed by Bug 751012)
Attachment #713173 - Attachment description: testcase → testcase (crashes Firefox when loaded)
Testcase works for me in a local m-c debug build on Linux64, without any assertions, and also works in an ASan build.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
Flags: in-testsuite? → in-testsuite+
Assignee: nobody → jruderman
You need to log in before you can comment on or make changes to this bug.