866955 - "ASSERTION: Placeholder relationship should have been torn down already" with -moz-column, fixed pos

Status: NEW

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file layout/generic/nsFrame.cpp, line 620

Same assertion as bug 856269, different testcase.

Comment 1

[Jesse Ruderman]

Attachment: stack (gdb)

Comment 2

[Mats Palmgren (inactive)]

Attachment: frame dump

Comment 3

[Mats Palmgren (inactive)]

I think the problem here is that nsBlockFrame::RemoveFrame deletes continuations
in order.  I think it would be more robust if we delete them in reverse order,
like nsContainerFrame::DeleteNextInFlowChild does.

Similarly, the problem in bug 856269 is that we delete the lines in order.

I propose that we make nsBlockFrame::RemoveFrame delete both continuations and
lines in reverse order.  Does anyone see a problem with that?

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

No, that sounds good.

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Fwiw I recorded this on layout/base/crashtests/423107-1.xhtml.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Bug 1110277 patch 3 makes the one annotated occurrence of this in the crashtest suite go away.

Comment 7

[Karl Tomlinson (:karlt)]

Attachment: annotate 423107-1.xhtml crashtest assertion failure

Comment 5 was triggered again by
https://hg.mozilla.org/integration/mozilla-inbound/rev/938041e183e5

Comment 8

[Mats Palmgren (inactive)]

Comment on attachment 8689805 [details] [diff] [review]
annotate 423107-1.xhtml crashtest assertion failure

r=mats

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6453b572ff54

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/6453b572ff54

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:svoisen, maybe it's time to close this bug?

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:svoisen, maybe it's time to close this bug?

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:svoisen, maybe it's time to close this bug?

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:svoisen, maybe it's time to close this bug?