898913 - "ASSERTION: no frame" and crash [@ nsHTMLReflowState::nsHTMLReflowState]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: no frame: 'aFrame', file /Users/jruderman/trees/mozilla-central/layout/generic/nsHTMLReflowState.cpp, line 141

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Mats Palmgren (inactive)]

Attachment: wip

nsCSSFrameConstructor::RemoveFloatingFirstLetterFrames
fails to remove floating first-letter frames if they
are on the kPushedFloatsList.

https://tbpl.mozilla.org/?tree=Try&rev=3ac8205b26b8
https://tbpl.mozilla.org/?tree=Try&rev=441782474e94

Comment 3

[Scoobidiver (away)]

On Windows: bp-6729a098-93b5-4f45-a8e1-f1d492130729.

Comment 4

[Mats Palmgren (inactive)]

Attachment: fix+test

Look for the floating first-letter frame to remove on the kPushedFloatsList too.

https://tbpl.mozilla.org/?tree=Try&rev=cedd2002b079
https://tbpl.mozilla.org/?tree=Try&rev=c1e538f4acca

Comment 5

[Daniel Holbert [:dholbert]]

Sorry for the delay on this - I was traveling for a good chunk of the last week, and this slipped off my radar.

Hoping to review this before I leave the office tonight.

Comment 6

[Daniel Holbert [:dholbert]]

Comment on attachment 784620 [details] [diff] [review]
fix+test

Seems reasonable.

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1efba891f53b