Closed Bug 865602 Opened 12 years ago Closed 12 years ago

Crash [@ nsCSSFrameConstructor::CreateContinuingFrame] with -moz-column, fieldset, abs pos

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla23

People

(Reporter: jruderman, Assigned: MatsPalmgren_bugz)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(5 files)

testcase (crashes Firefox when loaded)
(deleted), text/html
Details
stack
(deleted), text/plain
Details
frame dump at the crash
(deleted), text/html
Details
fix+test
(deleted), patch
roc
: review+
Details | Diff | Splinter Review
frame tree with fix
(deleted), text/plain
Details
No description provided.
Attached file stack (deleted) —
Attached file frame dump at the crash (deleted) —
Assignee: nobody → matspal
Attached patch fix+test (deleted) — — Splinter Review
I think it's OK for a fieldset overflow container to have a null child block frame. https://tbpl.mozilla.org/?tree=Try&rev=a03cc5df0174
Attached file frame tree with fix (deleted) —
Here's the fully reflowed frame tree with the fix.
On Windows: bp-c582f191-7b1d-430f-b1dd-7e1ef2130425.
Crash Signature: [@ nsCSSFrameConstructor::CreateContinuingFrame(nsPresContext*, nsIFrame*, nsIFrame*, bool)]
OS: Mac OS X → All
Hardware: x86_64 → All
Attachment #741782 - Flags: review?(roc)
https://hg.mozilla.org/mozilla-central/rev/e58195e26c4f
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: