Closed
Bug 956046
Opened 10 years ago
Closed 10 years ago
"Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' set on the element between two anonymous flex items
Categories
(Core :: Layout, defect)
Core
Layout
Tracking
()
RESOLVED
FIXED
mozilla29
People
(Reporter: cbook, Assigned: dholbert)
References
()
Details
(Keywords: assertion, testcase)
Attachments
(4 files)
found via bughunter loading http://fr.liberty-tree.net/forum/la-machine-caf/quiz-travers-san-andreas-vice-city-et-liberty-city?page=5#new with a windows 7 trunk debug build (according to bughunter this is on all platforms and branches). Loading this site (if not crash on load just shift-reload the page) it crashes with Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)) Will try to generate a local testcase, also marking as security bug, but feel free to open
Assignee | ||
Comment 1•10 years ago
|
||
I can reproduce on 64-bit linux trunk. Probably not a security bug -- this is just a correctness assertion -- but I'll dig in a bit more before unhiding.
Hardware: x86 → All
Assignee | ||
Comment 2•10 years ago
|
||
Assignee | ||
Updated•10 years ago
|
Keywords: testcase
Summary: Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)) → Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)) with 'order' and abspos ::before and ::after in a flex container
Assignee | ||
Updated•10 years ago
|
Summary: Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)) with 'order' and abspos ::before and ::after in a flex container → "Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' and abspos ::before and ::after in a flex container
Assignee | ||
Comment 3•10 years ago
|
||
Here's a simpler testcase. Basically, if we have two anonymous flex items separated by a flex item that gets sorted out from between them (due to "order), then it busts the assertion about no-consecutive-anonymous-flex-items. Which maybe means the assertion is just invalid in cases where we're reordering items due to "order"...
Assignee | ||
Comment 4•10 years ago
|
||
(In any case, this isn't security-sensitive.)
Group: core-security
Summary: "Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' and abspos ::before and ::after in a flex container → "Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' set on the element between two anonymous flex items
Assignee | ||
Updated•10 years ago
|
Assignee: nobody → dholbert
Status: NEW → ASSIGNED
Assignee | ||
Comment 5•10 years ago
|
||
Per end of comment 3, this assertion (which checks that we don't have any anonymous flex item adjacent to another anonymous flex item) isn't valid if we've reordered our (non-anonymous) children with "order". This patch neuters the assertion in that case. Reftest (based on "testcase 2" here) included.
Attachment #8355339 -
Flags: review?(dbaron)
Assignee | ||
Updated•10 years ago
|
Flags: in-testsuite?
Comment on attachment 8355339 [details] [diff] [review] fix v1: neuter assertion when children have been reordered r=dbaron
Attachment #8355339 -
Flags: review?(dbaron) → review+
Assignee | ||
Comment 9•10 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/8342bfb3ef52
Flags: in-testsuite? → in-testsuite+
Reporter | ||
Comment 10•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/8342bfb3ef52
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
You need to log in
before you can comment on or make changes to this bug.
Description
•