284575 - Crash when dynamically adding rowspan and border to table-cells [@ TableBackgroundPainter::PaintCell ]

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase. The testcase crashes my current trunk build for 100%.
Talkback is currently down.

This looks like a regression:
Doesn't crash in 2004-04-16 8:45am
Crashes in 2004-04-20 12:42am
The only bug that might have got something to do with it, as far as I can see,
is bug 237078.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Bernd]

It crashes in background painting as the columns are not correct. The testcase
with standards rendering mode should crash even before.


Martijn. if you file a crash bug into the layout-table component please put me
on CC.

Comment 3

[Alessio]

Talkback ID: TB4084829K
(Mozilla 1.8b2 build 2005022504)

Comment 4

[Bernd]

Attachment: patch

Comment 5

[Mats Palmgren (inactive)]

Comment on attachment 176442 [details] [diff] [review]
patch

The change looks reasonable and it does fix the crash.
I don't know the table code well enough yet to feel comfortable doing
reviews on it though, sorry. Bumping the request to Boris.

Comment 6

[Boris Zbarsky [:bzbarsky]]

So why are we using aColIndex + 1 and not aColIndex + numNewCells?

Comment 7

[Bernd]

Its enough 
          for (PRInt32 cellX = 0; cellX < numNewCells; cellX++) {
             nsTableCellFrame* cell =
(nsTableCellFrame*)aCellFrames->ElementAt(cellX);
             if (cell) {
               AppendCell(aMap, cell, rowX, PR_FALSE, aDamageArea);
             }
           }
will append all cells that we want. We might assert on numOrigCols >= aColIndex
There should *never* aColIndex be by say 5 larger than numOrigCols. 

Comment 8

[Bernd]

I checked in patch mentioning this bug, but that was wrong it was bug 280009.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 176442 [details] [diff] [review]
patch

Add that assert that numOrigCols >= aColIndex and r=bzbarsky

Comment 10

[Bernd]

fix checked in