Closed Bug 1342177 Opened 5 years ago Closed 5 years ago

stylo: Figure out why dom/base/crashtests/387460-1.html crashes

Categories

(Core :: CSS Parsing and Computation, defect)

defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 1323647
Tracking Status
firefox54 --- affected

People

(Reporter: bzbarsky, Unassigned)

References

Details

We're ending up in nsCellMapColumnIterator::GetNextFrame in this code:

  while (1) {
    NS_ASSERTION(mCurMapRow < mCurMapRelevantRowCount, "Bogus mOrigCells?");
    // Safe to just get the row (which is faster than calling GetDataAt(), but
    // there may not be that many cells in it, so have to use SafeElementAt for
    // the mCol.
    const nsCellMap::CellDataArray& row = mCurMap->mRows[mCurMapRow];
    CellData* cellData = row.SafeElementAt(mCol);

The NS_ASSERTION fails: both values are 0.  Then the next bit crashes, because mCurMap is null.

mOrigCells is 2.  mFoundCells is 1.  Our cellmap thinks there are two cells originating in column 0, which is wrong, afaict: with that rowspan there should be only one cell originating there.

Why _stylo_ is involved and in what capacity I can't tell yet.
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1323647
You need to log in before you can comment on or make changes to this bug.