trying to style mozilla.org with 200px wide columns crashes (note that 50px columns work). before that, I get lots of assertions (see below) steps to reproduce: 1. load http://www.mozilla.org 2. load javascript:void(document.body.style.MozColumnWidth='200px') See attachments for the assertions I get and the stack. note that the assertions also contain assertions for setting column-width to 50px; sorry about that.

Summary: - lots of: ###!!! ASSERTION: bad state: 'aState.mContentArea.width >= aState.mAvailSpaceRect.XMost()', file /home/chb/mozilla/layout/generic/nsBlockFrame.cpp, line 4317 - a few: ###!!! ASSERTION: bad geometric parent: 'IsChild(aNextInFlow)', file /home/chb/mozilla/layout/generic/nsBlockFrame.cpp, line 5402 - many: ###!!! ASSERTION: can't find deleted frame in lines: 'Error', file /home/chb/mozilla/layout/generic/nsBlockFrame.cpp, line 5255

Summary: 0x418f147a in nsLineBox::IsEmpty (this=0x871d6d4) at /home/chb/mozilla/layout/generic/nsLineBox.cpp:286 286 if (!kid->IsEmpty()) (gdb) bt #0 0x418f147a in nsLineBox::IsEmpty (this=0x871d6d4) at /home/chb/mozilla/layout/generic/nsLineBox.cpp:286 #1 0x418f1520 in nsLineBox::CachedIsEmpty (this=0x871d6d4) at /home/chb/mozilla/layout/generic/nsLineBox.cpp:303 #2 0x4189f024 in nsBlockFrame::PlaceLine (this=0x86b5d3c, aState=@0xbfffb380, aLineLayout=@0xbfffadf0, aLine= {mCurrent = 0x871d6d4, mListLink = 0x86b5d78}, aKeepReflowGoing=0xbfffb158, aUpdateMaximumWidth=0) (gdb) print kid $1 = (class nsIFrame *) 0x0

this may also be of interest: (gdb) print mFirstChild $2 = (class nsIFrame *) 0x8720160 (gdb) print GetChildCount() $3 = 2 (gdb) print mFirstChild->GetNextSibling() $4 = (nsIFrame *) 0x0 I was using current cvs seamonkey trunk, gtk1, when crashing.

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a6) Gecko/20041212 It doesn´t crash, but height is reduced, values seen in DOM-Inspector. Screen resolution 800x600, original width 742 px, original height 813 px reduced to 578 px, doesn´t matter if styled to 200 or 50 px.

loading this testcase crashes linux trunk 2004121205

<div style="height: 100px; float: left;"></div> <div style="height: 50px;"></div> <script>document.body.style.MozColumnWidth='200px';</script>

(In reply to comment #7) > Created an attachment (id=168593) [edit] > even simpler testcase regressed on windows between BuildID 2004100707 and 2004100806 http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=comments&match=contains&searchfor=Bug+274342&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041007-05 ok Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041007-07 Firefox/0.9.1+ ok Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041008-06 Firefox/0.9.1+ crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041009-06 Firefox/0.9.1+ crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041011-07 crash

> regressed on windows between BuildID 2004100707 and 2004100806 that's just the landing of CSS3 column support (bug 251162). it's not really a regression.

This could be similar to bug 263825.

Fixed by the checkin for bug 263825. I wouldn't say the results are pleasing, but we don't crash :-).

Verified FIXED with https://bugzilla.mozilla.org/attachment.cgi?id=168593 and https://bugzilla.mozilla.org/attachment.cgi?id=168592 using build 2005-03-23-05 on Windows XP Seamonkey trunk.