Created attachment 743316 [details] testcase ###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file layout/generic/nsFrame.cpp, line 620 Same assertion as bug 856269, different testcase.
I think the problem here is that nsBlockFrame::RemoveFrame deletes continuations in order. I think it would be more robust if we delete them in reverse order, like nsContainerFrame::DeleteNextInFlowChild does. Similarly, the problem in bug 856269 is that we delete the lines in order. I propose that we make nsBlockFrame::RemoveFrame delete both continuations and lines in reverse order. Does anyone see a problem with that?
No, that sounds good.
Fwiw I recorded this on layout/base/crashtests/423107-1.xhtml.
Bug 1110277 patch 3 makes the one annotated occurrence of this in the crashtest suite go away.
Created attachment 8689805 [details] [diff] [review] annotate 423107-1.xhtml crashtest assertion failure Comment 5 was triggered again by https://hg.mozilla.org/integration/mozilla-inbound/rev/938041e183e5
Attachment #8689805 - Flags: review?(mats)
Assignee: karlt → nobody
Status: ASSIGNED → NEW
Comment on attachment 8689805 [details] [diff] [review] annotate 423107-1.xhtml crashtest assertion failure r=mats
Attachment #8689805 - Flags: review?(mats) → review+
You need to log in before you can comment on or make changes to this bug.