Jesse Ruderman Reporter
	Description • 18 years ago

Nightly: [@ nsHTMLReflowState::ComputeRelativeOffsets]
Debug: Crash [@ nsIFrame::GetParent] called from GetNearestContainingBlock

###!!! ASSERTION: Placeholder relationship should have been torn down: '!shell->FrameManager()->GetPlaceholderFrameFor(mOutOfFlowFrame)', file /Users/admin/trunk/mozilla/layout/generic/nsPlaceholderFrame.cpp, line 89

###!!! ASSERTION: no placeholder frame: 'nsnull != placeholderFrame', file /Users/admin/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1044

	(not currently active) Ted Mielczarek
	Comment 2 • 18 years ago

Crashes on WinXP too.

	(not currently active) Ted Mielczarek
	Comment 3 • 18 years ago

Stack, courtesy of airbag:

[ 0]  ebp = 0x0012e5b0  eip = 0x0075fae0  "C:\build\mozilla\debugbuild.vc8\dist\bin\firefox.exe" + 0x0035fae0 GetNearestContainingBlock (c:\build\mozilla\layout\generic\nshtmlreflowstate.cpp:662)
[ 1]  ebp = 0x0012e5f8  eip = 0x00760b0e  "C:\build\mozilla\debugbuild.vc8\dist\bin\firefox.exe" + 0x00360b0e nsHTMLReflowState::InitAbsoluteConstraints (c:\build\mozilla\layout\generic\nshtmlreflowstate.cpp:1059)
[ 2]  ebp = 0x0012e624  eip = 0x00761899  "C:\build\mozilla\debugbuild.vc8\dist\bin\firefox.exe" + 0x00361899 nsHTMLReflowState::InitConstraints (c:\build\mozilla\layout\generic\nshtmlreflowstate.cpp:1965)
[ 3]  ebp = 0x0012e644  eip = 0x00761a7b  "C:\build\mozilla\debugbuild.vc8\dist\bin\firefox.exe" + 0x00361a7b nsHTMLReflowState::Init (c:\build\mozilla\layout\generic\nshtmlreflowstate.cpp:344)
[ 4]  ebp = 0x0012e66c  eip = 0x00761fac  "C:\build\mozilla\debugbuild.vc8\dist\bin\firefox.exe" + 0x00361fac nsHTMLReflowState::nsHTMLReflowState (c:\build\mozilla\layout\generic\nshtmlreflowstate.cpp:318)
[ 5]  ebp = 0x0012e8dc  eip = 0x008e9091  "C:\build\mozilla\debugbuild.vc8\dist\bin\firefox.exe" + 0x004e9091 nsAbsoluteContainingBlock::ReflowAbsoluteFrame (c:\build\mozilla\layout\generic\nsabsolutecontainingblock.cpp:514)
[ 6]  ebp = 0x3000bde5  eip = 0x0012e904  "0x0" + 0x0012e904

	Stephen Donner [:stephend] Not actively reading bugmail
	Comment 4 • 18 years ago

Something seems to have fixed this, since I don't crash with today's Win32 Minefield or SeaMonkey trunk builds.

	(not currently active) Ted Mielczarek
	Comment 5 • 18 years ago

This no longer crashes for me.

	Boris Zbarsky [:bzbarsky]
	Comment 6 • 18 years ago

The fix for bug 322625 probably fixed this, since it fixed an inconsistency in GetAbsoluteContainingBlock.

	Boris Zbarsky [:bzbarsky]
	Comment 7 • 18 years ago

Oh, and the checkin range when this got fixed is http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=MozillaTinderboxAll&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-10-08+02&maxdate=2006-10-09+02&cvsroot=%2Fcvsroot

	Stephen Donner [:stephend] Not actively reading bugmail
	Comment 8 • 18 years ago

Verified FIXED using build 2006-10-19-08 of SeaMonkey trunk under Windows XP; no crash on https://bugzilla.mozilla.org/attachment.cgi?id=240561

	Jesse Ruderman Reporter
	Comment 9 • 17 years ago

Crashtest checked in.

	Jesse Ruderman Reporter
	Comment 10 • 17 years ago

Now that the crashtest is in, refdyn noticed that the way the testcase is displayed isn't consistent.  See bug 409577.