1031934 - crash in nsTableRowFrame::CollapseRowIfNecessary(int, int, bool, bool&)

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

Attachment: collapserow_crash.html

See testcase, which crashes current trunk build on load.

This bug was filed from the Socorro interface and is 
report bp-98b452e6-6ddb-4299-a6b4-71c4b2140629.
=============================================================
0 	XUL 	nsTableRowFrame::CollapseRowIfNecessary(int, int, bool, bool&) 	layout/tables/nsTableRowFrame.cpp
1 	XUL 	nsTableRowGroupFrame::CollapseRowGroupIfNecessary(int, int) 	layout/tables/nsTableRowGroupFrame.cpp
2 	XUL 	nsTableFrame::AdjustForCollapsingRowsCols(nsHTMLReflowMetrics&, nsMargin) 	layout/tables/nsTableFrame.cpp
3 	XUL 	nsTableFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	layout/tables/nsTableFrame.cpp
4 	XUL 	nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, int, int, unsigned int, unsigned int&, nsOverflowContinuationTracker*) 	layout/generic/nsContainerFrame.cpp
5 	XUL 	nsTableOuterFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	layout/tables/nsTableOuterFrame.cpp
6 	XUL 	nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) 	layout/generic/nsBlockReflowContext.cpp
7 	XUL 	nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) 	layout/generic/nsBlockFrame.cpp
8 	XUL 	nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) 	layout/generic/nsBlockFrame.cpp
9 	XUL 	nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	layout/generic/nsBlockFrame.cpp
10 	XUL 	nsBlockReflowContext::ReflowBlock(nsRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, nsHTMLReflowState&, unsigned int&, nsBlockReflowState&) 	layout/generic/nsBlockReflowContext.cpp

Comment 1

[Mats Palmgren (inactive)]

https://tbpl.mozilla.org/?tree=Try&rev=43b0af83a8e0

Comment 2

[Mats Palmgren (inactive)]

Looks like this is a recent regression (June 18):
http://hg.mozilla.org/mozilla-central/diff/8bdccca2ba59/layout/tables/nsTableRowFrame.cpp

Comment 3

[Mats Palmgren (inactive)]

Attachment: fix+tests

https://tbpl.mozilla.org/?tree=Try&rev=43b0af83a8e0
https://tbpl.mozilla.org/?tree=Try&rev=88ebf0e347ef

Comment 4

[Mats Palmgren (inactive)]

Attachment: wdiff of the code change

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 8447922 [details] [diff] [review]
fix+tests

Review of attachment 8447922 [details] [diff] [review]:
-----------------------------------------------------------------

::: layout/tables/reftests/1031934.html
@@ +3,5 @@
> +    <meta charset="utf-8">
> +    <title>Testcase for bug 1031934</title>
> +    <style type="text/css">
> +
> +td { display:none; }	

trailing whitespace here and in the reference

Comment 6

[Mats Palmgren (inactive)]

Thanks, I cleaned up the reftest a bit:
https://hg.mozilla.org/integration/mozilla-inbound/rev/5ea5059a6a60

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5ea5059a6a60