Loading content/base/crashtests/395469-1.xhtml triggers: ###!!! ASSERTION: Reframes of this letter frame will mess with the root of a native anonymous content subtree!: '!letterContent->IsRootOfNativeAnonymousSubtree()', file /Users/jruderman/central/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11570 This is a regression from within the last few days.

Mmm. I bet we're giving the letter frame the newly-added content node for the :before element. That's the right thing to be doing as far as the first-letter frame goes. I guess we could test whether this is OK by toggling the display or float or something on that first-letter to trigger an attempted frame reconstruct and seeing whether things blow up. I suspect at the moment they do. Perhaps we should make RecreateFramesForContent handle this case or something and then remove this assert?

Yeah, I think we'll have to walk up.

Here is the stack for the assertion.

roc has a stack somewhere to make RecreateFramesForContent deal, as I recall.

er, I meant a patch, not a stack

The patch for bug 460012 doesn't fix this.

Er, it doesn't fix the assert, but of course that's not the point. Let me look...

This testcase doesn't blow up, on trunk. It does cause ###!!! ASSERTION: FirstLetterStyle set on line with floating first letter: '!(outOfFlowFrame->GetType() == nsGkAtoms::letterFrame && GetFirstLetterStyleOK())', file /Users/roc/mozilla-checkin/layout/generic/nsLineLayout.cpp, line 902 I think because nsBlockFrame still thinks it has a first-letter in-flow child so calls SetFirstLetterStyleOK. Or something like that. But this assertion seems to be harmless.

With the patch for bug 460012, testcase #1 doesn't raise any assertions. So I think it's safe to say that the patch fixes this bug.

Fixed by 460012

Roc, sorry when I have to reopen this bug but opening the crashtest from comment 0 still show this assertion with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20081202 Minefield/3.2a1pre ###!!! ASSERTION: Reframes of this letter frame will mess with the root of a native anonymous content subtree!: '!letterContent->IsRootOfNativeAnonymousSubtree()', file /mozilla/src/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11860

This assertion is no longer needed, since we fixed the underlying problem in bug 460012.

Pushed 0e0c23ff64cf

(removing erroneous fixed1.9.1 marking - sorry)

Pushed 84c5e8702af9 to 1.9.1

The assertion isn't shown anymore when opening the crashtest from comment 0. Verified with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20081221 Minefield/3.2a1pre ID:20081221222459

David, this patch has been landed on mozilla-central after we branched for 1.9.1. The TM of any of such bugs we have already set to 1.9.2a1 while the fixed/verified keyword shows that it is fixed for Fx3.1. So why we should have 3.1b3 here?

Verified on 1.9.1 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090403 Shiretoko/3.5b4pre ID:20090403220515