866547 - "ASSERTION: wrong kind of child frame" with bidi, flexbox

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: wrong kind of child frame: 'aIsBlock == f->IsBlockOutside()', file ../../../layout/generic/nsLineBox.cpp, line 43

###!!! ASSERTION: Disagreement about whether it's a block or not: 'fromLine->IsBlock() == fromLine->mFirstChild->IsBlockOutside()', file ../../../layout/generic/nsBlockFrame.cpp, line 2580

Comment 1

[Mats Palmgren (inactive)]

A variation of bug 847211?  in this case we have this frame tree:

Block(div)(1) ... [sc=0x7fffcfcfe858:-moz-anonymous-flex-item]<
  line 0x7fffcfcfe550: count=2 state=inline,... <
    Text(0)" " ...
    Inline(_moz_generated_content_after)(-1) ... <
      Text(0)"A" ...
    >
  >
>

The "Inline" there has IsBlockOutside() = true.

Comment 2

[Daniel Holbert [:dholbert]]

Essentially, yes. (Looks like we're incorrectly adjusting the style of that element, thinking it's going to be a flex item, when really it's not.)

I'm currently digging into this.  Assigning.

Comment 3

[Daniel Holbert [:dholbert]]

So, this is a case where we're inconsistently blockifying an "::after" pseudo-element's "display" property.

This will likely be fixed by bug 867454 - marking dependency.

Comment 4

[Daniel Holbert [:dholbert]]

Fixed by bug 867454, with this bug's testcase included as a crashtest.