Closed Bug 865602 Opened 6 years ago Closed 6 years ago

Crash [@ nsCSSFrameConstructor::CreateContinuingFrame] with -moz-column, fieldset, abs pos

Categories

(Core :: Layout, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla23

People

(Reporter: jruderman, Assigned: mats)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(5 files)

No description provided.
Attached file stack
Assignee: nobody → matspal
Attached patch fix+testSplinter Review
I think it's OK for a fieldset overflow container to have a null
child block frame.

https://tbpl.mozilla.org/?tree=Try&rev=a03cc5df0174
Attached file frame tree with fix
Here's the fully reflowed frame tree with the fix.
On Windows: bp-c582f191-7b1d-430f-b1dd-7e1ef2130425.
Crash Signature: [@ nsCSSFrameConstructor::CreateContinuingFrame(nsPresContext*, nsIFrame*, nsIFrame*, bool)]
OS: Mac OS X → All
Hardware: x86_64 → All
Attachment #741782 - Flags: review?(roc)
https://hg.mozilla.org/mozilla-central/rev/e58195e26c4f
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.