Closed
Bug 358729
Opened 18 years ago
Closed 18 years ago
"ASSERTION: Some frame destructors were not called" with tables, block-in-inline, rtl
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, rtl, testcase, Whiteboard: [sg:critical?] [reflow-refactor] post 1.8-branch)
Attachments
(1 file)
|
(deleted),
application/xhtml+xml
|
Details |
I got some sg:critical looking crashes while reducing this, but I wasn't able to get it crashing again once I had a reduced testcase. Because of the crashes with intermediate testcases, and because most bugs that trigger "ASSERTION: Some frame destructors were not called" can be used to cause exploitable crashes, I'm making this security-sensitive.
|
Reporter | |
Comment 1•18 years ago
|
||
|
||
Comment 2•18 years ago
|
||
So I dunno what's going on here, but if I uncomment the code at http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsCSSFrameConstructor.cpp&rev=1.1278&mark=12936#12929 the assertion goes away. It also goes away on the reflow branch.
I wonder whether this warning in non-reflow-branch builds:
WARNING: blowing an incremental reflow targeted at a nested inline: file
../../../mozilla/layout/generic/nsBlockFrame.cpp, line 1735
is relevant...
Whiteboard: [reflow-refactor]
|
|
Reporter | |
Updated•18 years ago
|
Whiteboard: [reflow-refactor] → [sg:critical?] [reflow-refactor]
|
|
Reporter | |
Comment 3•18 years ago
|
||
I can't test whether the reflow branch landing fixed this bug until bug 363149 is fixed.
|
|
||
Updated•18 years ago
|
Flags: blocking1.9?
|
|
Reporter | |
Comment 4•18 years ago
|
||
WFM with Mac trunk. Probably fixed by the reflow branch landing.
|
|
||
Updated•18 years ago
|
No longer blocks: reflow-refactor
Depends on: reflow-refactor
|
||
Updated•18 years ago
|
Whiteboard: [sg:critical?] [reflow-refactor] → [sg:critical?] [reflow-refactor] post 1.8-branch
|
|
||
Comment 5•18 years ago
|
||
Sorry, I meant to add this:
Jess told me that I needed to apply the patch in bug 334514 to test whether this assertion existed on the branch. I did so on the 1.8 branch and did not see the assertion in my build.
|
||
Updated•18 years ago
|
Flags: wanted1.8.1.x-
|
||
Comment 6•18 years ago
|
||
sounds like this one is ready to close. right?
|
|
Reporter | |
Comment 7•18 years ago
|
||
Group: security
Resolution: FIXED → WORKSFORME
|
|
||
Updated•17 years ago
|
Flags: blocking1.9?
|
||
Comment 9•17 years ago
|
||
Mass-assigning the new rtl keyword to RTL-related (see bug 349193).
Keywords: rtl
You need to log in
before you can comment on or make changes to this bug.
Description
•