Closed Bug 11441 Opened 21 years ago Closed 18 years ago

[Blocker] Crash in table reflow

Categories

(Core :: Layout: Tables, defect, P3, blocker)

x86
Windows NT
defect

Tracking

()

RESOLVED FIXED

People

(Reporter: slogan, Assigned: karnaze)

References

Details

Contact syd@netscape.com for steps to reproduce.

Here is the stack trace:

nsTableFrame::DidComputeHorizontalCollapsingBorders(nsIPresContext & {...}, int
0, int 10000) line 982 + 11 bytes
nsTableFrame::ResizeReflowPass2(nsTableFrame * const 0x0ba6e620, nsIPresContext
& {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 2654
nsTableFrame::Reflow(nsTableFrame * const 0x0ba6e624, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 2316 + 38 bytes
nsTreeFrame::Reflow(nsTreeFrame * const 0x0ba6e624, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 294
nsContainerFrame::ReflowChild(nsIFrame * 0x0ba6e620, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
nsTableOuterFrame::IR_InnerTableReflow(nsTableOuterFrame * const 0x0ba6dac0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 600 + 34 bytes
nsTableOuterFrame::IR_TargetIsInnerTableFrame(nsTableOuterFrame * const
0x0ba6dac0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...},
OuterTableReflowState & {...}, unsigned int & 0) line 370 + 31 bytes
nsTableOuterFrame::IR_TargetIsChild(nsTableOuterFrame * const 0x0ba6dac0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0, nsIFrame * 0x0ba6e620) line 342 + 31 bytes
nsTableOuterFrame::IncrementalReflow(nsTableOuterFrame * const 0x0ba6dac0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, OuterTableReflowState &
{...}, unsigned int & 0) line 324 + 35 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x0ba6dac4, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0) line 997 + 35 bytes
nsBoxFrame::FlowChildAt(nsIFrame * 0x0ba6dac0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0,
nsCalculatedBoxInfo & {...}, int & 0, nsString & {...}) line 856
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0ba6dac0, nsCalculatedBoxInfo & {...}) line 226
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3ae270, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0a3ae230, nsCalculatedBoxInfo & {...}) line 180
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3220f0, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0a3220b0, nsCalculatedBoxInfo & {...}) line 180
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3205d8, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::GetChildBoxInfo(nsIPresContext & {...}, const nsHTMLReflowState &
{...}, nsIFrame * 0x0a320598, nsCalculatedBoxInfo & {...}) line 180
nsBoxFrame::GetBoxInfo(nsBoxFrame * const 0x0a3aac40, nsIPresContext & {...},
const nsHTMLReflowState & {...}, nsBoxInfo & {...}) line 1229 + 44 bytes
nsBoxFrame::Reflow(nsBoxFrame * const 0x0a3aac04, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 322
nsContainerFrame::ReflowChild(nsIFrame * 0x0a3aac00, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
RootFrame::Reflow(RootFrame * const 0x0b3ba434, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 327
nsContainerFrame::ReflowChild(nsIFrame * 0x0b3ba430, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 439 + 28 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0b3b48f4, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 513
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0babe520,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...},
nsIRenderingContext & {...}) line 169
PresShell::ProcessReflowCommands(PresShell * const 0x0b33d830) line 1184
PresShell::ExitReflowLock(PresShell * const 0x0b33d830) line 564
PresShell::ContentAppended(PresShell * const 0x0b33d838, nsIDocument *
0x0b319200, nsIContent * 0x0ba8a8f0, int 0) line 1564
XULDocumentImpl::ContentAppended(XULDocumentImpl * const 0x0b319200, nsIContent
* 0x0ba8a8f0, int 0) line 1962
RDFElementImpl::AppendChildTo(RDFElementImpl * const 0x0ba8a8f0, nsIContent *
0x0ba93fa0, int 1) line 1696
Summary: Crash in table reflow after adding table content → Crash in table reflow
Also crashes when displaying content for first time in a table that has content.
Found an easy way to do this. Go to tasks menu, bring up messenger. You will get
a couple of unrelated asserts, which you can F5 through, and then you will crash
with the same stack trace I was seeing.
Severity: normal → blocker
Summary: Crash in table reflow → [Blocker] Crash in table reflow
cc: bienvenu and putterman since syd had mentioned messenger below.
yes, I see the same crash. this is very recent - i think it started happening
yesterday.
Try backing out the recent changes to layout/base/src/nsStyleContext.cpp and see
if this goes away for you.  It did for me.
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → FIXED
Yes, I believe this is fixed by backing out the nsStylecontext change, which dp
has done.
Status: RESOLVED → REOPENED
From Peter Lins:

No, absolutely not. The bug should be noted so that the crash only happens if
'border-collapse' is set to 'collapse' (which is all my change did). This is a
perfectly legal value and table reflow should not crash due to it. (This value
can be set via a style sheet and still cause the crash)

So I'm re-opening. It's no longer a blocker for Mail/News - I'll leave it up to
syd to say if he's still blocked/
If this bug is not fixed, please remove the resolution. Thanks
Resolution: FIXED → ---
clearing resolution
Blocks: 11468
It looks like we're seeing this same crash in the address book on Linux Bug
11468. I'm pretty sure that is from after we backed out nsStyleContext.cpp.  So
it looks like we still have a problem.
Status: REOPENED → ASSIGNED
Target Milestone: M9
Status: ASSIGNED → RESOLVED
Closed: 21 years ago21 years ago
Resolution: --- → REMIND
Syd, If backing out the style changes, didn't fix the crash for you, please
change the status back. I'm marking this remind, since I don't have a test case.
Status: RESOLVED → VERIFIED
Verified Remind.
Status: VERIFIED → CLOSED
Looks to me like it is basically working again.
REMIND is deprecated.
Status: CLOSED → REOPENED
Resolution: REMIND → ---
FIXED per syd's comment.
Status: REOPENED → RESOLVED
Closed: 21 years ago18 years ago
Resolution: --- → FIXED
QA Contact: chrisd → amar
You need to log in before you can comment on or make changes to this bug.