Closed
Bug 399687
Opened 17 years ago
Closed 17 years ago
"ASSERTION: aPrevFrame must be the last continuation in its chain!" with -moz-column, overflowing height
Categories
(Core :: Layout, defect, P5)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: fantasai.bugs)
References
Details
(Keywords: assertion, testcase, Whiteboard: [dbaron-1.9:RsCo])
Attachments
(2 files)
(deleted),
text/html
|
Details | |
(deleted),
patch
|
roc
:
review+
roc
:
superreview+
beltzner
:
approval1.9+
|
Details | Diff | Splinter Review |
###!!! ASSERTION: aPrevFrame must be the last continuation in its chain!: '!aPrevFrame || !aPrevFrame->GetNextContinuation()', file /Users/jruderman/trunk/mozilla/layout/base/nsFrameManager.cpp, line 672
I think this can lead to crashes where Firefox dereferences 0xdddddddd.
Flags: blocking1.9?
Reporter | ||
Updated•17 years ago
|
Whiteboard: [sg:critical?]
Updated•17 years ago
|
OS: Mac OS X → All
Well then, we'll need to fix the crashes. This right here is expected behavior: the new frame should inserted right after ocontainer where it visually ends, not where it logically ends. Do you have any testcases that actually crash with this assert?
Reporter | ||
Comment 2•17 years ago
|
||
This bug is about an assertion failure, not the visual rendering of the testcase, so the "expected behavior" is not triggering an assertion failure :)
I could try to make another reduced testcase for a crash. Should I wait until this assertion is fixed and bug 399843 is fixed, though? It's tricky to make reduced testcases for crashes when there are other crashes around.
Assignee: nobody → fantasai.bugs
Status: NEW → ASSIGNED
Attachment #285134 -
Flags: superreview?(roc)
Attachment #285134 -
Flags: review?(roc)
Attachment #285134 -
Flags: approval1.9?
What I'm saying is, I don't expect this assertion to be indicating a potential crash. If it is, that means other code has problems.
Keywords: crash
Reporter | ||
Comment 5•17 years ago
|
||
Ok, I'll try to make a reduced testcase for one of the crashes I saw along with this assertion.
Group: security
Severity: critical → normal
Whiteboard: [sg:critical?]
Flags: blocking1.9? → blocking1.9+
Updated•17 years ago
|
Whiteboard: [dbaron-1.9:RsCo]
Attachment #285134 -
Flags: superreview?(roc)
Attachment #285134 -
Flags: superreview+
Attachment #285134 -
Flags: review?(roc)
Attachment #285134 -
Flags: review+
Attachment #285134 -
Flags: approval1.9?
Attachment #285134 -
Flags: approval1.9+
Comment on attachment 285134 [details] [diff] [review]
patch to update assertion
Request approval when we get out of tree-red state
Attachment #285134 -
Flags: approval1.9+
Reporter | ||
Comment 7•17 years ago
|
||
(In reply to comment #5)
> Ok, I'll try to make a reduced testcase for one of the crashes I saw along
> with this assertion.
Filed bug 400223.
Attachment #285134 -
Flags: approval1.9?
Comment 8•17 years ago
|
||
Comment on attachment 285134 [details] [diff] [review]
patch to update assertion
a=drivers for after M9 freeze
Attachment #285134 -
Flags: approval1.9? → approval1.9+
Keywords: checkin-needed
Priority: -- → P5
Assignee | ||
Comment 10•17 years ago
|
||
Fix checked in: nsFrameManager.cpp rev 1.257
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Updated•17 years ago
|
Flags: in-testsuite?
Comment 12•16 years ago
|
||
Comment on attachment 285134 [details] [diff] [review]
patch to update assertion
layout/base/nsFrameManager.cpp:682: warning: suggest parentheses around && within ||
Was this really the order of operations that you wanted?
You need to log in
before you can comment on or make changes to this bug.
Description
•