Closed Bug 1338007 Opened 8 years ago Closed 7 years ago

stylo: layout/generic/crashtests/309322-1.html crashes in nsIFrame::SetNextSibling

Categories

(Core :: CSS Parsing and Computation, defect, P3)

defect

Tracking

()

RESOLVED FIXED
mozilla55
Tracking Status
firefox55 --- fixed

People

(Reporter: heycam, Unassigned)

References

(Blocks 1 open bug)

Details

layout/generic/crashtests/309322-1.html produces a number of assertions and then crashes. ###!!! ASSERTION: How did we get here? Frame construction screwed up: 'Not Reached', file /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp, line 2353 ###!!! ASSERTION: How did this produce an nsTableRowGroupFrame?: 'Not Reached', file /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp, line 2862 ###!!! ASSERTION: How did this produce an nsTableRowGroupFrame?: 'Not Reached', file /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp, line 2862 ###!!! ASSERTION: not in child list: 'found', file /home/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp, line 1505 ###!!! ASSERTION: can't remove inner frame: 'kCaptionList == aListID', file /home/worker/workspace/build/src/layout/tables/nsTableWrapperFrame.cpp, line 153 ###!!! ASSERTION: Broken frame linkage: 'prevSibling && prevSibling->GetNextSibling() == aFrame', file /home/worker/workspace/build/src/layout/generic/nsFrameList.cpp, line 91 ###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aNextSibling', file /home/worker/workspace/build/src/layout/generic/nsIFrame.h, line 1453 Crash reason: SIGSEGV Crash address: 0x30 libxul.so!nsIFrame::SetNextSibling [nsIFrame.h:8a0041a6365b : 1454 + 0x0] libxul.so!nsFrameList::RemoveFrame [nsFrameList.cpp:8a0041a6365b : 92 + 0xb] libxul.so!nsFrameList::DestroyFrame [nsFrameList.cpp:8a0041a6365b : 137 + 0xb] libxul.so!nsTableWrapperFrame::RemoveFrame [nsTableWrapperFrame.cpp:8a0041a6365b : 162 + 0xc] libxul.so!nsFrameManager::RemoveFrame [nsFrameManager.cpp:8a0041a6365b : 506 + 0x13] libxul.so!nsCSSFrameConstructor::ContentRemoved [nsCSSFrameConstructor.cpp:8a0041a6365b : 8526 + 0x15] libxul.so!nsCSSFrameConstructor::RecreateFramesForContent [nsCSSFrameConstructor.cpp:8a0041a6365b : 9716 + 0x5] libxul.so!mozilla::RestyleManagerBase::ProcessRestyledFrames [RestyleManagerBase.cpp:8a0041a6365b : 1183 + 0x17] libxul.so!mozilla::ServoRestyleManager::ProcessPendingRestyles [ServoRestyleManager.cpp:8a0041a6365b : 369 + 0xb] libxul.so!mozilla::PresShell::FlushPendingNotifications [PresShell.cpp:8a0041a6365b : 4171 + 0x23] libxul.so!mozilla::PresShell::FlushPendingNotifications [PresShell.cpp:8a0041a6365b : 4061 + 0x7] libxul.so!nsDocument::FlushPendingNotifications [nsDocument.cpp:8a0041a6365b : 7962 + 0x6] libxul.so!mozilla::dom::Element::GetPrimaryFrame [Element.cpp:8a0041a6365b : 2167 + 0xc] libxul.so!mozilla::dom::Element::GetBoundingClientRect [Element.cpp:8a0041a6365b : 970 + 0xb] libxul.so!mozilla::dom::ElementBinding::getBoundingClientRect [ElementBinding.cpp:8a0041a6365b : 2085 + 0x8] libxul.so!mozilla::dom::GenericBindingMethod [BindingUtils.cpp:8a0041a6365b : 2959 + 0x6] libxul.so!js::CallJSNative [jscntxtinlines.h:8a0041a6365b : 281 + 0x6] libxul.so!js::InternalCallOrConstruct [Interpreter.cpp:8a0041a6365b : 460 + 0x16] libxul.so!js::Call [Interpreter.cpp:8a0041a6365b : 524 + 0x5] libxul.so!js::jit::InvokeFunction [VMFunctions.cpp:8a0041a6365b : 114 + 0x5]
Priority: -- → P3
Pushed by cmccormack@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/76831b11ec44 Remove comments from already re-enabled tests. r=me (DONTBUILD)
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
You need to log in before you can comment on or make changes to this bug.