348049 - [FIX]Frames not destroyed with this XBL + <td> testcase

Status: VERIFIED FIXED

(Core :: XBL, defect, P1)

Description

[Jesse Ruderman]

1. Load either testcase.

Result: ###!!! ASSERTION: unsupported operation: 'PR_FALSE', nsTableCellFrame::AppendFrames

2. Reload.

Result: Assuming the patch from 334514 is applied, you'll see another assertion: "Some frame destructors were not called".

Result: If you're using the crashing testcase, you're likely to see a crash attempting to dereference 0xdadadaf6.

Comment 1

[Jesse Ruderman]

Attachment: testcase (non-crashing)

Comment 2

[Jesse Ruderman]

Attachment: testcase (crashing)

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: I think this is the right fix

Comment 4

[Boris Zbarsky [:bzbarsky]]

roc, what do you think of the branch-safety of this patch?  I think it's pretty safe myself....

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 233506 [details] [diff] [review]
I think this is the right fix

Well, it does change behaviour in several cases, but everywhere it changes behaviour it's almost certainly fixing a similar bug, so I think we should take it on branches.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 233506 [details] [diff] [review]
I think this is the right fix

We should probably take this on branches.  This doesn't change behavior in most cases; all the ones where it does probably led to crashes anyway.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 233506 [details] [diff] [review]
I think this is the right fix

a=dbaron on behalf of drivers.  Please check in to the MOZILLA_1_8_BRANCH and add the fixed1.8.1 keyword once you have done so.

Comment 9

[Daniel Veditz [:dveditz]]

Comment on attachment 233506 [details] [diff] [review]
I think this is the right fix

approved for 1.8.0 branch, a=dveditz for drivers

Comment 10

[Boris Zbarsky [:bzbarsky]]

Fixed on branches.

Comment 11

[Bob Clary [:bc] (inactive)]

https://bugzilla.mozilla.org/attachment.cgi?id=232924
ff2b2 debug windows/linux no assert

https://bugzilla.mozilla.org/attachment.cgi?id=232925
ff2b2 debug/nightly windows/linux no crash

verified fixed 1.8 (happyfish)

Comment 12

[alice nodelman [:alice] [:anode]]

https://bugzilla.mozilla.org/attachment.cgi?id=232925&action=view should not crash browser

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7pre) Gecko/20060821 Firefox/1.5.0.7pre

verified 1.8.0.7

more happy fishes!

Comment 13

[Jesse Ruderman]

Crashtest checked in.

Comment 14

[Boris Zbarsky [:bzbarsky]]

I checked in a reftest for this too.