1342177 - stylo: Figure out why dom/base/crashtests/387460-1.html crashes

Status: RESOLVED DUPLICATE of bug 1323647

(Core :: CSS Parsing and Computation, defect)

Description

[Boris Zbarsky [:bzbarsky]]

We're ending up in nsCellMapColumnIterator::GetNextFrame in this code:

  while (1) {
    NS_ASSERTION(mCurMapRow < mCurMapRelevantRowCount, "Bogus mOrigCells?");
    // Safe to just get the row (which is faster than calling GetDataAt(), but
    // there may not be that many cells in it, so have to use SafeElementAt for
    // the mCol.
    const nsCellMap::CellDataArray& row = mCurMap->mRows[mCurMapRow];
    CellData* cellData = row.SafeElementAt(mCol);

The NS_ASSERTION fails: both values are 0.  Then the next bit crashes, because mCurMap is null.

mOrigCells is 2.  mFoundCells is 1.  Our cellmap thinks there are two cells originating in column 0, which is wrong, afaict: with that rowspan there should be only one cell originating there.

Why _stylo_ is involved and in what capacity I can't tell yet.