10176 - relatively positioned table causes crash

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

A relatively positioned table seems to cause a crash.  Simplified test case to
be attached

Top of stack trace looks like:

#0  0x4097c82b in nsLineLayout::TreatFrameAsBlock ()
#1  0x4096354a in nsBlockFrame::AddFrames ()
#2  0x40963275 in nsBlockFrame::AppendFrames ()
#3  0x40a302b8 in nsCSSFrameConstructor::AppendFrames ()
#4  0x40a304d2 in nsCSSFrameConstructor::ContentAppended ()
#5  0x40ab6923 in StyleSetImpl::ContentAppended ()
#6  0x40983792 in PresShell::ContentAppended ()
#7  0x40a94d28 in nsDocument::ContentAppended ()
#8  0x409f99da in nsHTMLDocument::ContentAppended ()
#9  0x409f3a1b in HTMLContentSink::WillInterrupt ()
#10 0x401c57cc in CNavDTD::WillInterruptParse ()

I'm seeing a totally different stack trace if the table has a caption.  I'll
file that as a separate bug.

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I didn't mean to cc: peterl on this... sorry for the spam.

Comment 2

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: test case causing crash

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Actually looking closer, it's probably the same crash.  Here's the stack trace
with the caption:

#0  0x40a2b4e7 in nsCSSFrameConstructor::ConstructTableCaptionFrame ()
#1  0x40a2f61d in nsCSSFrameConstructor::ConstructFrameByDisplayType ()
#2  0x40a2fd68 in nsCSSFrameConstructor::ConstructFrame ()
#3  0x40a2a92f in nsCSSFrameConstructor::ProcessChildren ()
#4  0x40a2f42a in nsCSSFrameConstructor::ConstructFrameByDisplayType ()
#5  0x40a2fd68 in nsCSSFrameConstructor::ConstructFrame ()
#6  0x40a30466 in nsCSSFrameConstructor::ContentAppended ()
#7  0x40ab6923 in StyleSetImpl::ContentAppended ()
#8  0x40983792 in PresShell::ContentAppended ()
#9  0x40a94d28 in nsDocument::ContentAppended ()
#10 0x409f99da in nsHTMLDocument::ContentAppended ()
#11 0x409f3a1b in HTMLContentSink::WillInterrupt ()

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: test case causing crash, with caption

Comment 5

[Chris Petersen]

With the July 26th build (1999072608), the problem is fixed.