Closed
Bug 413079
Opened 17 years ago
Closed 16 years ago
Crash [@ nsBlockFrame::DoRemoveFrame] with -moz-column, float
Categories
(Core :: Layout, defect, P2)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Assigned: roc)
References
Details
(Keywords: assertion, crash, testcase, Whiteboard: [sg:critical?])
Crash Data
Attachments
(3 files)
Loading the testcase makes Firefox crash [@ nsBlockFrame::DoRemoveFrame] dereferencing 0xdddddde5 (or sometimes another address).
Before the crash, I see:
###!!! ASSERTION: unexpected flow: 'mFrames.ContainsFrame(nextInFlow)', file /Users/jruderman/trunk/mozilla/layout/generic/nsInlineFrame.cpp, line 470
|
Reporter | |
Updated•17 years ago
|
Summary: Crash [@ nsBlockFrame::DoRemoveFrame] → Crash [@ nsBlockFrame::DoRemoveFrame] with -moz-column, float
Whiteboard: [sg:critical?]
|
|
Reporter | |
Updated•17 years ago
|
Flags: blocking1.9?
|
||
Comment 1•17 years ago
|
||
No crash on branch.
|
|
Reporter | |
Updated•17 years ago
|
Priority: -- → P1
|
Assignee | |
Updated•17 years ago
|
Flags: blocking1.9? → blocking1.9+
Priority: P1 → P2
|
||
Comment 2•17 years ago
|
||
Robert: please find an owner for this security bug, thanks.
Assignee: nobody → roc
|
|
Assignee | |
Updated•17 years ago
|
Flags: wanted1.9.0.x+
Flags: blocking1.9-
|
||
Updated•17 years ago
|
Flags: tracking1.9+
while I do see the assert with a current nightly I do not see the crash and the assert. I see however: "nsBlockFrame::CheckFloats: Explicit float list is out of sync with float cache" where the lines do not have a float while mFloats on the block shows one element.
s/while I do see the assert with a current nightly/
while I do see the crash with a current nightly/
it still triggers the warning:
WARNING: nsBlockFrame::CheckFloats: Explicit float list is out of sync with float cache: file d:/moz_src/mozilla/layout/generic/nsBlockFrame.cpp, line 6700
WARNING: This situation currently leads to data not printing: '!NS_FRAME_IS_TRUNCATED(reflowStatus)', file d:/moz_src/mozilla/layout/generic/nsBlockReflowState.cpp, line 1084
|
|
Reporter | |
Comment 7•17 years ago
|
||
This and the other -moz-column + float bugs are really getting in the way of my testing. They keep showing up with new assertions and new crash signatures :(
|
|
Reporter | |
Comment 8•16 years ago
|
||
WFM, Mac trunk debug on Tiger.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
|
|
||
Updated•16 years ago
|
Group: core-security
|
|
||
Updated•16 years ago
|
Flags: wanted1.9.0.x-
|
|
Reporter | |
Updated•16 years ago
|
Flags: in-testsuite+
|
||
Updated•13 years ago
|
Crash Signature: [@ nsBlockFrame::DoRemoveFrame]
You need to log in
before you can comment on or make changes to this bug.
Description
•