"ASSERTION: Placeholder relationship should have been torn down already" with -moz-column, fixed pos

NEW
Unassigned

Status

()

6 years ago
2 years ago

People

(Reporter: jruderman, Unassigned)

Tracking

(Depends on: 1 bug, Blocks: 1 bug, {assertion, leave-open, testcase})

Trunk
x86_64
Mac OS X
assertion, leave-open, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [rr])

Attachments

(4 attachments)

(Reporter)

Description

6 years ago
Created attachment 743316 [details]
testcase

###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file layout/generic/nsFrame.cpp, line 620

Same assertion as bug 856269, different testcase.
(Reporter)

Comment 1

6 years ago
Created attachment 743318 [details]
stack (gdb)
Created attachment 743818 [details]
frame dump
I think the problem here is that nsBlockFrame::RemoveFrame deletes continuations
in order.  I think it would be more robust if we delete them in reverse order,
like nsContainerFrame::DeleteNextInFlowChild does.

Similarly, the problem in bug 856269 is that we delete the lines in order.

I propose that we make nsBlockFrame::RemoveFrame delete both continuations and
lines in reverse order.  Does anyone see a problem with that?
Fwiw I recorded this on layout/base/crashtests/423107-1.xhtml.
Whiteboard: [rr]
Bug 1110277 patch 3 makes the one annotated occurrence of this in the crashtest suite go away.
Created attachment 8689805 [details] [diff] [review]
annotate 423107-1.xhtml crashtest assertion failure

Comment 5 was triggered again by
https://hg.mozilla.org/integration/mozilla-inbound/rev/938041e183e5
Attachment #8689805 - Flags: review?(mats)
Assignee: nobody → karlt
Status: NEW → ASSIGNED
Assignee: karlt → nobody
Blocks: 1198613
Status: ASSIGNED → NEW
Keywords: leave-open
Comment on attachment 8689805 [details] [diff] [review]
annotate 423107-1.xhtml crashtest assertion failure

r=mats
Attachment #8689805 - Flags: review?(mats) → review+
You need to log in before you can comment on or make changes to this bug.