238537 - 1.7beta topcrash [@ nsTableRowFrame::SetContinuousBCBorderWidth]

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[chris hofmann]

talkback analysis dump of nsTableRowFrame::SetContinuousBCBorderWidth info

 [ 2   nsTableRowFrame::SetContinuousBCBorderWidth 36431faf -
nsTableRowFrame::SetContinuousBCBorderWidth ]

     (3786)	URL: http://www.crsky.com/index.htm
     (3786)	Comments: when I try to search   I enter cuteftp pro   and it crash

[ 1   nsTableRowFrame::SetContinuousBCBorderWidth 72e56faf -
nsTableRowFrame::SetContinuousBCBorderWidth ]

     (3400)	URL: www.koolance.com/parts
     (3400)	Comments: Looking at parts and accessories
 
[ 1   nsTableRowFrame::SetContinuousBCBorderWidth 2683f385 -
nsTableRowFrame::SetContinuousBCBorderWidth ]

     (4420)	URL: http://www.micronet.com.tw/Products/voip/voip.asp
     (4420)	Comments: Go to the page   select from the left menu: Products -
VoIP Telephony  (the same link as provided).

Comment 1

[Matthias Versen [:Matti]]

I can reproduce this crash in my optimized with symbols build on win2k with this
URL : http://www.micronet.com.tw/Products/voip/voip.asp

Comment 2

[Bernd]

if (info.cell) {
5838           info.cell->SetBorderWidth(NS_SIDE_LEFT, PR_MAX(smallHalf,
info.cell->GetBorderWidth(NS_SIDE_LEFT)));
5839         }
5840         if (info.leftCol) {
5841           info.leftCol->SetLeftBorderWidth(PR_MAX(smallHalf,
info.leftCol->GetLeftBorderWidth()));
5842         }
5843         propData->mLeftBorderWidth =
LimitBorderWidth(PR_MAX(propData->mLeftBorderWidth, ownerWidth));
5844         //get row continuous borders
5845         CalcDominantBorder(this, info.cg, info.leftCol, info.rg, rowFrame,
nsnull, PR_TRUE, NS_SIDE_LEFT,
5846                            PR_FALSE, t2p, owner, ownerBStyle, ownerWidth,
ownerColor);
5847         rowFrame->SetContinuousBCBorderWidth(NS_SIDE_LEFT, ownerWidth);

all calls to Set(Left)BorderWidth are zero pointer protected the
SetContinousBCBorder calls are not. There is no guarantee that these frames are
valid. Or more precisely there is a guarantee that under some conditions they
are invalid.

Comment 3

[Bernd]

Attachment: patch

Sorry fantasai, but I need to get this thing fixed. I will be away starting
from next saturday and the patch should go in rather soon.

Comment 4

[fantasai]

Attachment: patch based on Bernd's comments

No, I'm sorry, Bernd. I had the patch written last night, I just forgot to push

the submit button when I was attaching it. :/

My version is a little different, though; it puts the Calculate calls inside
the
frame check. (There's no point in doing the calculations if the frame isn't
there.)

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Could you attach a diff -ub ?  (-b means indentation changes are ignored, basically)

Comment 6

[fantasai]

Attachment: diff -up8b

Comment 7

[Bernd]

taking for checkin

Comment 8

[chris hofmann]

Comment on attachment 144872 [details] [diff] [review]
patch based on Bernd's comments

a=chofmann for 1.7

Comment 9

[Bernd]

fix checked in

Comment 10

[Boris Zbarsky [:bzbarsky]]

*** Bug 241052 has been marked as a duplicate of this bug. ***

Comment 11

[Jay Patel [:jay]]

No crashes with Mozilla 1.7rc1 or current Trunk Talkback data.  Marking verified.