Closed Bug 322820 Opened 19 years ago Closed 18 years ago

Crash [@ nsCSSFrameConstructor::RemoveFirstLetterFrames] with evil testcase, using float:right; and .u::first-letter

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla1.9alpha1

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

References

()

Details

(Keywords: crash, regression, testcase)

Crash Data

This is split of from bug 318592, see bug 318592, comment 10 and further.

The url makes Mozilla crash on load.
Doesn't crash in 2005-03-22 build, crashes in 2005-02-23 build.
Maybe regression from bug 263825?

Talkback data from TB12496055E:
nsCSSFrameConstructor::RemoveFirstLetterFrames 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 12779]
nsCSSFrameConstructor::RemoveLetterFrames 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 12845]
nsCSSFrameConstructor::ContentRemoved 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9814]
nsCSSFrameConstructor::ReinsertContent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 9492]
PresShell::CharacterDataChanged 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5398]
nsGenericDOMDataNode::SetData 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericDOMDataNode.cpp,
line 354]
nsCommentNode::SetData 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsCommentNode.cpp,
line 59]
nsHTMLFormElement::AddRef
0xf9a8e918
This is actually fixed by the patch in bug 317275
Depends on: 317275
Assignee: nobody → bzbarsky
Fixed by checkin for bug 317275
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9alpha
Verified fixed, using latest nightly trunk build.
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsCSSFrameConstructor::RemoveFirstLetterFrames]
You need to log in before you can comment on or make changes to this bug.