111405 - crash if line-height property defined in userContent.css M096 [@ nsRuleNode::ComputeTextData]

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[OGURA Junya]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.6) Gecko/20011120
BuildID:    2001112009

If "line-height" property defined in "userContent.css" then Mozilla crashes then
redering simply HTML that has one TABLE element and one TEXTAREA element.

userContent.css ----------------------------------------

* { line-height:120%; }

--------------------------------------------------------


simply.html --------------------------------------------
<TABLE>
  <TBODY>
    <TR>
      <TD>
        <TEXTAREA name="text" rows="10" cols="60"></TEXTAREA>
      </TD>
    </TR>
  </TBODY>
</TABLE>
--------------------------------------------------------


Reproducible: Always
Steps to Reproduce:
1.Add "* { line-height:120%; }" in userContent.css
2.Run Mozilla
3.Open simply.html
4.Crashes


Actual Results:  Mozilla crashes.


Expected Results:  Rendering one TABLE and one TEXTAREA form.

Comment 1

[Julien Cegarra]

Confirmed. BuildID: 2001112104 (Win98).

the sample miss a <link rel="stylesheet" type="text/css" 
href="userContent.css" />

attaching a right one.

Comment 2

[Julien Cegarra]

Attachment: testcase (html)

Comment 3

[Julien Cegarra]

Attachment: testcase (css)

Comment 4

[Julien Cegarra]

After a bit more work, i find that the prob is due to line-height applied to a
<TABLE ..> containing a textarea.

<TABLE STYLE="line-height:120%;"><TR><TD>
<TEXTAREA name="text" rows="10" cols="60"></TEXTAREA>
</TD></TR></TABLE>

Comment 5

[Julien Cegarra]

Attachment: Second testcase

Comment 6

[Adam Hauner]

Sev: normail --> critical
Key: +crash

TB38365087W with 2001112104/WinNT4

Comment 7

[Matthias Versen [:Matti]]

confirming with http://bugzilla.mozilla.org/showattachment.cgi?attach_id=58848 
and
win2k build 20011120..

Comment 8

[Matthias Versen [:Matti]]

Attachment: Stack trace

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The problem was that I was computing percentage line heights relative to the
parent's font size rather than the font size of the element itself.  Once I fix
that, there's no need to worry about a null check.

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 11

[Pierre Saslawsky]

Comment on attachment 59118 [details] [diff] [review]
patch

r=pierre

Comment 12

[David Hyatt]

sr=hyatt

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in 2001-11-27 20:35 PDT.

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 112787 has been marked as a duplicate of this bug. ***

Comment 15

[Jay Patel [:jay]]

Adding M096 and topcrash keyword for tracking...this was a topcrasher with
Mozilla 0.9.6.

Comment 16

[Madhur Bhatia]

verified fixed on buildid :2002-04-22-1.0.0 branch