Closed Bug 840787 Opened 11 years ago Closed 11 years ago

Crash with -moz-column, float, changing text

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jruderman, Assigned: jruderman)

References

Details

(Keywords: assertion, crash, testcase)

Crash Data

Attachments

(2 files)

testcase (crashes Firefox when loaded)
448 bytes, text/html
Details
stack
31.40 KB, text/plain
Details 
###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../layout/base/nsLayoutUtils.cpp, line 4808

###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../layout/generic/nsFrame.cpp, line 633

###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../layout/base/../generic/nsPlaceholderFrame.h, line 162

This might just be another symptom of bug 600100.
Attached file stack — 

    
  
Crash Signature: [@ nsLayoutUtils::AssertTreeOnlyEmptyNextInFlows(nsIFrame*)]

    
    

    
  
FYI
The testcase attachment 713173 [details] crashes. (see Bug 772320 Comment#12 and regressed by Bug 751012)

    
  

        Attachment #713173 -
        Attachment description: testcase → testcase (crashes Firefox when loaded)

    
    

    
  
Testcase works for me in a local m-c debug build on Linux64,
without any assertions, and also works in an ASan build.
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME

    
    

    
  
Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e636b91b1cbb
Flags: in-testsuite? → in-testsuite+

          You need to log in
          before you can comment on or make changes to this bug.