crash in nsTableFrame::FixupPositionedTableParts with vertical writing mode

RESOLVED WORKSFORME

Status

()

RESOLVED WORKSFORME
4 years ago
a year ago

People

(Reporter: jfkthame, Unassigned)

Tracking

({testcase})

unspecified
testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

4 years ago
Running the testcase from gfx/tests/crashtests/783041-2.html with writing-mode:vertical-lr applied to the <body> element will generate a number of assertions, then crash in nsTableFrame::FixupPositionedTableParts.

Although we don't yet implement vertical layout for table elements (and therefore some assertions here are not surprising), we should at least avoid crashing.
(Reporter)

Comment 1

4 years ago
Created attachment 8579325 [details]
Testcase

Testcase created by adding vertical writing mode to the original gfx crashtest.

NB: crashes a current trunk build if writing-mode support is enabled.
(Reporter)

Comment 2

4 years ago
Assertions we hit when loading this testcase include:

 0:26.47 [32686] ###!!! ASSERTION: Table width is less than the sum of its columns' min widths: '!(aWidthType == BTLS_FINAL_WIDTH && aWidth < guess_min)', file layout/tables/BasicTableLayoutStrategy.cpp, line 816

 0:26.63 [32686] ###!!! ASSERTION: didn't subtract all that we added: '(space == 0 || space == nscoord_MAX) && ((l2t == FLEX_PCT_LARGE) ? (-0.001f < basis.f && basis.f < 0.001f) : (basis.c == 0 || basis.c == nscoord_MAX))', file layout/tables/BasicTableLayoutStrategy.cpp, line 1061

 0:26.78 [32686] ###!!! ASSERTION: Shouldn't be incomplete if availableBSize is UNCONSTRAINED.: 'aReflowState.AvailableBSize() != NS_UNCONSTRAINEDSIZE', file layout/generic/nsBlockFrame.cpp, line 1570

 0:26.87 [32686] ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file layout/base/nsLayoutUtils.cpp, line 6876

 0:27.56 [32686] ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file layout/base/nsLayoutUtils.cpp, line 6890

 0:26.47 [32686] ###!!! ASSERTION: Table width is less than the sum of its columns' min widths: '!(aWidthType == BTLS_FINAL_WIDTH && aWidth < guess_min)', file layout/tables/BasicTableLayoutStrategy.cpp, line 816

 0:26.63 [32686] ###!!! ASSERTION: didn't subtract all that we added: '(space == 0 || space == nscoord_MAX) && ((l2t == FLEX_PCT_LARGE) ? (-0.001f < basis.f && basis.f < 0.001f) : (basis.c == 0 || basis.c == nscoord_MAX))', file layout/tables/BasicTableLayoutStrategy.cpp, line 1061

Comment 3

3 years ago
The testcase in comment 1 does not crash for me.
WFM in a local Linux debug build.
Flags: in-testsuite?
The test was green on Try so I pushed it and calling this WFM.
Status: NEW → RESOLVED
Last Resolved: a year ago
No longer depends on: 1405443
Flags: in-testsuite? → in-testsuite+
Keywords: testcase
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.