Closed
Bug 413388
Opened 17 years ago
Closed 16 years ago
"ASSERTION: Some objects allocated with AllocateFrame were not freed" with -moz-column, inline-block
Categories
(Core :: Layout, defect, P3)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Assigned: roc)
References
Details
(4 keywords, Whiteboard: [sg:critical?][cannot reproduce])
Attachments
(1 file)
|
(deleted),
application/xhtml+xml
|
Details |
Closing (or reloading) the testcase triggers:
###!!! ASSERTION: Some objects allocated with AllocateFrame were not freed: 'mFrameCount == 0', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 673
This appears to be exploitable in the usual way.
(Also, the letter 't' fails to appear.)
Flags: blocking1.9?
|
||
Updated•17 years ago
|
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2
|
Assignee | |
Updated•17 years ago
|
Assignee: nobody → roc
|
|
Assignee | |
Comment 1•17 years ago
|
||
For some reason we create a fifth column here during reflow, which is rather strange.
|
|
Assignee | |
Updated•17 years ago
|
Flags: wanted1.9.0.x+
Flags: blocking1.9-
|
||
Updated•17 years ago
|
Flags: tracking1.9+
|
Reporter | |
Comment 2•16 years ago
|
||
I can still reproduce this bug on trunk.
|
|
Reporter | |
Updated•16 years ago
|
Flags: blocking1.9.1?
|
|
Assignee | |
Updated•16 years ago
|
Flags: blocking1.9.1? → blocking1.9.1+
Priority: P2 → P3
|
|
Assignee | |
Comment 3•16 years ago
|
||
WFM on trunk. It doesn't even assert.
Whiteboard: [sg:critical?] → [sg:critical?][cannot reproduce]
|
|
Reporter | |
Comment 4•16 years ago
|
||
WFM here too.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
|
||
Updated•16 years ago
|
Flags: wanted1.9.0.x-
Flags: wanted1.9.0.x+
Flags: blocking1.9.1+
|
||
Updated•9 years ago
|
Group: core-security → core-security-release
|
|
||
Updated•9 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•