Closed
Bug 545574
Opened 15 years ago
Closed 14 years ago
Crash [@ nsOverflowContinuationTracker::Insert] with -moz-column, height
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Unassigned)
References
Details
(Keywords: assertion, crash, testcase, Whiteboard: [sg:dos (critical w/out frame-poisoning)])
Crash Data
Attachments
(1 file)
|
(deleted),
application/xhtml+xml
|
Details |
###!!! ASSERTION: frame to add has different parent: 'IsEmpty() || FirstChild()->GetParent() == aFrameList.FirstChild()->GetParent()', file /Users/jruderman/mozilla-central/layout/generic/nsFrameList.cpp, line 214 ###!!! ASSERTION: Creating a circular frame list, this is very bad.: 'this != aNextSibling', file /Users/jruderman/mozilla-central/layout/base/../generic/nsIFrame.h, line 906 Crashes in a random function, but always with nsOverflowContinuationTracker::Insert on the stack, and always touching null or the poison address.
|
Reporter | |
Comment 1•15 years ago
|
||
|
|
Reporter | |
Comment 2•14 years ago
|
||
WFM
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
|
Assignee | |
Updated•13 years ago
|
Crash Signature: [@ nsOverflowContinuationTracker::Insert]
|
||
Updated•9 years ago
|
Group: core-security → core-security-release
|
||
Updated•9 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•