Jesse Ruderman Reporter
	Description • 16 years ago

Loading the testcase triggers:

###!!! ASSERTION: prev sibling not in line list: 'Not Reached', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 4805

###!!! ASSERTION: unknown out of flow frame type: 'disp->mDisplay == NS_STYLE_DISPLAY_POPUP', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 522

	Jesse Ruderman Reporter
	Comment 1 • 16 years ago

I think this can lead to scary crashes.

Is this bug related to bug 401042?

	Boris Zbarsky [:bzbarsky] Assignee
	Comment 2 • 16 years ago

This looks like a bidi screwup to me...  We call SplitInlineAncestors on the textframe inside the firstLetter.  Then we try to split the float and stick it in the in-flow child list, which breaks.

I suppose first-letter needs to be eBidiInlineContainer to handle cases when it's not floated, eh?

	Robert O'Callahan (:roc) (email my personal email if necessary)
	Comment 4 • 16 years ago

Comment on attachment 331231 [details] [diff] [review]
This seems to do the trick

I'm not really sure how first-letter is supposed to behave with bidi. I think Simon's looked into it a little bit?

	Simon Montagu :smontagu
	Comment 5 • 16 years ago

Comment on attachment 331231 [details] [diff] [review]
This seems to do the trick

Umm. This regresses bug 384527 (which should show up as a test failure), but that may well be because my patch there depended on the previous buggy behaviour, like around https://bugzilla.mozilla.org/attachment.cgi?id=278544&action=diff#mozilla/layout/base/nsBidiPresUtils.cpp_sec4

	Boris Zbarsky [:bzbarsky] Assignee
	Comment 6 • 16 years ago

Hmm.  I'll make sure to run that test and see what happens.  Thanks for the code pointer!

	Jesse Ruderman Reporter
	Comment 7 • 15 years ago

WFM on trunk.  bz, do you care about the fate of your patch on this bug?

	Boris Zbarsky [:bzbarsky] Assignee
	Comment 8 • 15 years ago

Not particularly, no.

	Boris Zbarsky [:bzbarsky] Assignee
	Comment 9 • 15 years ago

That said, I'd like to know why it WFY.  Did something get changed?

	Simon Montagu :smontagu
	Comment 10 • 15 years ago

Could be a consequence of bug 332655 or one of its follow-ups

	Simon Montagu :smontagu
	Comment 11 • 15 years ago

That said, I still see the assertions on trunk (OS X and Linux)

	Timothy Nikkel (:tnikkel)
	Comment 12 • 15 years ago

Should be fixed by bug 491547.

Push testcase as crashtest
http://hg.mozilla.org/mozilla-central/rev/4597c9ddc1ff

	Jesse Ruderman Reporter
	Comment 13 • 15 years ago

Variations still crash, see bug 534768.  Thanks for adding the crashtest, tn ;)

	Jesse Ruderman Reporter
	Comment 14 • 15 years ago

Variations still crash, see bug 534768.  Thanks for adding the crashtest, tn ;)