3037 - Setting a "display: table-cell" style rule on a SPAN crashes viewer

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect, P2)

Description

[Nisheeth Ranjan]

The following XML snippet crashes the viewer:

<?xml version="1.0"?>
<window xmlns:html="http://www.w3.org/TR/REC-html40">
<window xmlns:xul
="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<!DOCTYPE window>

<window>
  <xul:toolbox>
    <xul:toolbar>
	  <html:span style="display: table-cell">
          <html:button cmd="nsCmd:BrowserBack"
style="background-color:rgb(192,192,192);">
                          <html:img
src="resource:/res/toolbar/TB_Back.gif"/><html:BR/>Back
          </html:button>
          </html:span>
          <html:span style="display: table-cell">
		  <html:input style="width:325px;"></html:input>
          </html:span>
    </xul:toolbar>
  </xul:toolbox>
</window>

The stack trace is:

nsDebug::PreCondition(char * 0x006aac78, char * 0x006aac50, char * 0x006aac1c,
int 574) line 112 + 13 bytes
nsTableFrame::GetEffectiveRowSpan(int 0, nsTableCellFrame * 0x012c2120) line 574
+ 51 bytes
nsTableRowFrame::PlaceChild(nsIPresContext & {...}, RowReflowState & {...},
nsIFrame * 0x012c2120, const nsRect & {...}, nsSize * 0x0012c69c, nsSize *
0x0012c484) line 437 + 31 bytes
nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x012c1f20,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...},
unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 820
nsTableRowFrame::Reflow(nsTableRowFrame * const 0x012c1f24, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 1393 + 39 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x012c1f20, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 363 + 28 bytes
nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const
0x012c1470, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000,
nsReflowReason eReflowReason_Initial, int 1) line 371 + 34 bytes
nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x012c1474,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState &
{...}, unsigned int & 0) line 978 + 39 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x012c1470, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 363 + 28 bytes
nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x012c1b70, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason
eReflowReason_Initial, int 1) line 2527
nsTableFrame::Reflow(nsTableFrame * const 0x012c1b74, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 2381 + 43 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x012c1b70, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 363 + 28 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x012c1984, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 943 + 37 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x012c1980, const nsRect & {...},
int 1, nsMargin & {...}, unsigned int & 0) line 155 + 39 bytes
nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x012c4390, int & 1) line 2098 + 45 bytes
nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x012c4390,
int & 1) line 1564 + 20 bytes
nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1300 + 26 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4938
nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x012c13e4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 804 + 25 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x012c13e4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 4571 + 25 bytes
nsToolbarFrame::Reflow(nsToolbarFrame * const 0x012c13e4, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 128
nsToolboxFrame::Reflow(nsToolboxFrame * const 0x012c1124, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 299 + 31 bytes
nsInlineReflow::ReflowFrame(int 0, nsHTMLReflowMetrics & {...}, unsigned int &
0) line 447
nsInlineReflow::ReflowFrame(nsIFrame * 0x012c1120, int 0, unsigned int & 0) line
269 + 20 bytes
nsInlineFrame::ReflowInlineFrame(nsInlineFrame::ReflowState & {...}, nsIFrame *
0x012c1120, unsigned int & 0) line 1409 + 18 bytes
nsInlineFrame::ReflowInlineFrames(nsInlineFrame::ReflowState & {...},
nsHTMLReflowMetrics & {...}, unsigned int & 0) line 1335 + 23 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x012c0704, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1246 + 26 bytes
nsInlineReflow::ReflowFrame(int 0, nsHTMLReflowMetrics & {...}, unsigned int &
0) line 447
nsInlineReflow::ReflowFrame(nsIFrame * 0x012c0700, int 0, unsigned int & 0) line
269 + 20 bytes
nsInlineFrame::ReflowInlineFrame(nsInlineFrame::ReflowState & {...}, nsIFrame *
0x012c0700, unsigned int & 0) line 1409 + 18 bytes
nsInlineFrame::ReflowInlineFrames(nsInlineFrame::ReflowState & {...},
nsHTMLReflowMetrics & {...}, unsigned int & 0) line 1335 + 23 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x012c0bd4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 1246 + 26 bytes
nsInlineReflow::ReflowFrame(int 1, nsHTMLReflowMetrics & {...}, unsigned int &
0) line 447
nsInlineReflow::ReflowFrame(nsIFrame * 0x012c0bd0, int 1, unsigned int & 0) line
269 + 20 bytes
nsBaseIBFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineBox *
0x012c4890, nsIFrame * 0x012c0bd0, int & 1, int & 1) line 2248 + 31 bytes
nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x012c4890,
int & 1) line 1606 + 28 bytes
nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1300 + 26 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4938
nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x012c08f4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 804 + 25 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x012c08f4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 4571 + 25 bytes
nsAreaFrame::Reflow(nsAreaFrame * const 0x012c08f4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 508 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x012c08f0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 363 + 28 bytes
RootFrame::Reflow(RootFrame * const 0x012c0584, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 248
nsContainerFrame::ReflowChild(nsIFrame * 0x012c0580, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 363 + 28 bytes
nsScrollFrame::Reflow(nsScrollFrame * const 0x01298fb4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 340
nsContainerFrame::ReflowChild(nsIFrame * 0x01298fb0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 363 + 28 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0123e904, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 427
PresShell::InitialReflow(PresShell * const 0x012bdd00, int 7344, int 3576) line
726
nsXMLContentSink::StartLayout() line 1330
nsXMLContentSink::DidBuildModel(nsXMLContentSink * const 0x01275bf0, int 1) line
261
CWellFormedDTD::DidBuildModel(CWellFormedDTD * const 0x0124adb0, unsigned int 0,
int 1, nsIParser * 0x01275af0, nsIContentSink * 0x01275bf0) line 300 + 20 bytes
nsParser::DidBuildModel(unsigned int 0) line 482 + 55 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000) line 714
nsParser::OnStopBinding(nsParser * const 0x01275af4, nsIURL * 0x012488c0,
unsigned int 0, unsigned short * 0x012473b0) line 934 + 17 bytes
nsDocumentBindInfo::OnStopBinding(nsDocumentBindInfo * const 0x01248870, nsIURL
* 0x012488c0, unsigned int 0, unsigned short * 0x012473b0) line 1734 + 30 bytes
OnStopBindingProxyEvent::HandleEvent(OnStopBindingProxyEvent * const 0x01247360)
line 594 + 45 bytes
StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x01247364) line 474 + 12
bytes
PL_HandleEvent(PLEvent * 0x01247364) line 472 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x011f1520) line 433 + 9 bytes
_md_EventReceiverProc(void * 0x0022052e, unsigned int 49340, unsigned int 0,
long 18814240) line 784 + 9 bytes
USER32! 77e713ed()

The pre condition that calls the user breakpoint and crashes the app is in
nsTableFrame::GetEffectiveRowSpan():

NS_PRECONDITION (0<=aRowIndex && aRowIndex<GetRowCount(), "bad row index arg");

Comment 1

[karnaze (gone)]

It no longer crashes. I don't know enough about xul to know if the test case is
right. The following simple html example illustrates that <span>s can have a
display of table-cell. If the xul is correct, please reopen this bug (or make
another) and assign it to rickg, because the content model of the original test
case does not look right.

<html>
<body>
<span style="display: table-cell">foo</span>
<span style="display: table-cell">bar</span>
</body>
</html>

Comment 2

[Christine Hoffman]

I will verify this as fixed in regards to crashing. No guarantees as to the
validity of the test case for other purposes.