997669 - crash in nsBlockFrame::ReflowPushedFloats(nsBlockReflowState&, nsOverflowAreas&, unsigned int&)

Status: RESOLVED DUPLICATE of bug 826978

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: crash1.htm

See testcase, which crashes current trunk build on load.

This bug was filed from the Socorro interface and is 
report bp-469edc88-afc7-41ef-8af3-871942140417.
=============================================================
0 	XUL 	nsBlockFrame::ReflowPushedFloats(nsBlockReflowState&, nsOverflowAreas&, unsigned int&) 	obj-firefox/x86_64/dist/include/nsTArray.h
1 	XUL 	nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	layout/generic/nsBlockFrame.cpp
2 	XUL 	nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, nsHTMLReflowState const&, nsRect const&, bool, nsIFrame*, unsigned int&, nsOverflowAreas*) 	layout/generic/nsAbsoluteContainingBlock.cpp
3 	XUL 	nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, nsHTMLReflowState const&, unsigned int&, nsRect const&, bool, bool, bool, nsOverflowAreas*) 	layout/generic/nsAbsoluteContainingBlock.cpp
4 	XUL 	nsFrame::ReflowAbsoluteFrames(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&, bool) 	layout/generic/nsFrame.cpp
5 	XUL 	nsFrame::DoLayout(nsBoxLayoutState&) 	layout/generic/nsFrame.cpp
6 	XUL 	nsIFrame::Layout(nsBoxLayoutState&) 	layout/xul/nsBox.cpp
7 	XUL 	nsSprocketLayout::Layout(nsIFrame*, nsBoxLayoutState&) 	layout/xul/nsSprocketLayout.cpp
8 	XUL 	nsBoxFrame::DoLayout(nsBoxLayoutState&) 	layout/xul/nsBoxFrame.cpp
9 	XUL 	nsBoxFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	layout/xul/nsBox.cpp
10 	XUL 	nsLineLayout::ReflowFrame(nsIFrame*, unsigned int&, nsHTMLReflowMetrics*, bool&) 	layout/generic/nsLineLayout.cpp

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

Reproducible desktop crash. Have a moment to take a look?

Comment 2

[Daniel Holbert [:dholbert]]

Not a recent regression; I can reproduce in a nightly from 2012-12-28, at least.

In a debug build, I get this assertion-failure right before the crash:
{
[4024] ###!!! ASSERTION: FloatManager should be set in nsBlockReflowState: 'mFloatManager', file $SRCDIR/layout/generic/nsBlockReflowState.cpp, line 67
}

which makes it seem likely to be a dupe of bug 826978. Marking as such.