Crash with table, position:sticky

RESOLVED FIXED in Firefox 42

Status

()

--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: jruderman, Assigned: bzbarsky)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla42
crash, regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox42 fixed)

Details

Attachments

(3 attachments, 1 obsolete attachment)

(Reporter)

Description

3 years ago
Created attachment 8633765 [details]
testcase (crashes Firefox)
(Reporter)

Updated

3 years ago
Blocks: 306939
(Reporter)

Comment 1

3 years ago
Created attachment 8633766 [details]
stack
(Assignee)

Comment 2

3 years ago
Created attachment 8634221 [details]
Testcase that actually crashes
Attachment #8633765 - Attachment is obsolete: true
(Assignee)

Comment 3

3 years ago
So the problem is that nsTableRowFrame::ReflowChildren is doing this:

994             LogicalMargin computedOffsets(wm, *static_cast<nsMargin*>
995               (kidFrame->Properties().Get(nsIFrame::ComputedOffsetProperty())));

but nsIFrame::ComputedOffsetProperty() returned null in this case.  kidFrame is an nsTableCellFrame....

Looks like StickyScrollContainer::ComputeStickyOffsets or nsHTMLReflowState::ComputeRelativeOffsets is supposed to set this prop.

In this case, the latter doesn't because we're not position:relative, and the former never happens because of bug 975644, which means we never reach ComputeStickyOffsets for table-internal stuff.
(Assignee)

Comment 4

3 years ago
Created attachment 8634272 [details] [diff] [review]
Don't assume that relatively positioned table cells actually have positioned offsets computed, because in the case of position:sticky they don't
Attachment #8634272 - Flags: review?(dholbert)
(Assignee)

Updated

3 years ago
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Comment on attachment 8634272 [details] [diff] [review]
Don't assume that relatively positioned table cells actually have positioned offsets computed, because in the case of position:sticky they don't

r=me
Attachment #8634272 - Flags: review?(dholbert) → review+
(BTW: the contextual code changed a little, but this patch still applies correctly with fuzz.)
https://hg.mozilla.org/mozilla-central/rev/8472aae68d5c
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
status-firefox42: affected → fixed
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
You need to log in before you can comment on or make changes to this bug.