348126 - Crash [@ nsImageFrame::SourceRectToDest] on reload and removing table-caption styles

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes on reload in current trunk build.
This regressed between 2005-12-03 and 2005-12-04, probably a regression from bug 309322.

I guess there is a security issue here.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes on reload)

Comment 2

[Martijn Wargers (dead)]

Attachment: animated gif

Argh! I forgot about the fish.

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase (crashes on reload)

Comment 4

[Martijn Wargers (dead)]

Attachment: Finally the good testcase (crashes on reload)

Comment 5

[Jesse Ruderman]

I can reproduce on Mac trunk (debug build).

On load:

###!!! ASSERTION: unexpected child list: 'PR_FALSE', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 243
###!!! ASSERTION: invalid previous frame: '!aPrevFrame', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 266
###!!! ASSERTION: unexpected child list: 'PR_FALSE', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 243
###!!! ASSERTION: illegal next frame in incremental reflow.: 'PR_FALSE', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1393

On reload, with the patch for bug 334514:

###!!! ASSERTION: Some frame destructors were not called.: 'mFrameCount == 0', file /Users/admin/trunk/mozilla/layout/base/nsPresShell.cpp, line 629

(One nice thing about using the patch for bug 334514 is that you can reload and see whether the assertion fires, rather than reloading an seeing whether Firefox crashes, if you take out the animated GIFs.)

Crash trying to read memory at 0xdadadaf6.

Dup of bug 337476?

Comment 6

[Martijn Wargers (dead)]

Yeah, could very well be the same bug.

Comment 7

[Bernd]

fixed by the checkin for bug bug 341858 

Comment 8

[Daniel Veditz [:dveditz]]

Moving to 1.8.1.5 following bug 309322

Comment 9

[Daniel Veditz [:dveditz]]

Moving to 1.8.1.6 following bug 309322

Comment 10

[Daniel Veditz [:dveditz]]

fix checked into branch with bug 309322

Comment 11

[Tony Chung [:tchung]]

Verified fix on Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.8) Gecko/20071004 Firefox/2.0.0.8: Firefox 2.0.0.8 ID:2007100415.   Testcase doesnt crash on reload. 

Comment 12

[Bob Clary [:bc] (inactive)]

crash test landed
http://hg.mozilla.org/mozilla-central/rev/3d0c408c687c