Closed Bug 1153695 Opened 10 years ago Closed 9 years ago

"Assertion failure: !nif || (!mFloats.ContainsFrame(nif) && !mFrames.ContainsFrame(nif))" with -moz-column

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla45
Tracking Flags:
Tracking Status
firefox40 --- affected
firefox45 --- fixed

People

(Reporter: jruderman, Assigned: MatsPalmgren_bugz)

References

Details

(Keywords: assertion, regression, testcase)

Attachments

(6 files)

testcase
(deleted), text/html
Details
stack
(deleted), text/plain
Details
frame dump + stack
(deleted), text/html
Details
fix, wdiff
(deleted), patch
roc
: review+
Details | Diff | Splinter Review
fix
(deleted), patch
Details | Diff | Splinter Review
crashtest
(deleted), patch
Details | Diff | Splinter Review
Attached file testcase (deleted) —
Assertion failure: !nif || (!mFloats.ContainsFrame(nif) && !mFrames.ContainsFrame(nif)), at layout/generic/nsBlockFrame.cpp:7419
Attached file stack (deleted) —
Is this a recent regression? It seems I can reproduce it my Aurora tree but not in Beta.
Keywords: regressionwindow-wanted
OS: Mac OS X → All
Hardware: x86_64 → All
Local bisection is pointing at bug 447660 as the culprit, more specifically http://hg.mozilla.org/mozilla-central/rev/56d432ad6ed6. That nicely explains why this doesn't reproduce on release builds until Fx39 but does on Nightly in the Fx37 range.
Blocks: 447660
Flags: needinfo?(mats)
Keywords: regressionwindow-wanted → regression
Attached file frame dump + stack (deleted) —
Uhm, some frames appear to be on two child lists. This is bad obviously, but fortunately it's a bit of a false alarm as it's a temporary situation and nothing bad can happen in this case.
Flags: needinfo?(mats)
Attached patch fix, wdiff (deleted) — — Splinter Review
The reason the frames appear on two lists is that nsAutoOOFFrameList is still in scope and it is its dtor that removes the OOF list. So we just need to wrap it in a scope to make sure that happens before the VerifyOverflowSituation() call.
Assignee: nobody → mats
Attachment #8687562 - Flags: review?(roc)
Attached patch fix (deleted) — — Splinter Review
Severity: critical → normal
Flags: needinfo?(mats) → in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/1ffc4b1f166c https://hg.mozilla.org/mozilla-central/rev/029ab28c46cc
Status: NEW → RESOLVED
Closed: 9 years ago
status-firefox45: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla45
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: