151054 - Crash with position: absolute applied to <math>

Status: RESOLVED FIXED

(Core :: MathML, defect)

Description

[Brian Rogers]

(Guessing at the component here)

The testcase I'm about to attach crashes.  I've reduced it to the following CSS
rule:
math { position: absolute; }

This occurs in Win2k on Mozilla 1.0 and 1.1a.  On Mozilla 1.0, it crashes while
loading the page.  On 1.1a, it crashes when you leave the page.

Comment 1

[Brian Rogers]

Attachment: Testcase, crashes

Comment 2

[Brian Rogers]

Talkback incidents (with 1.1a):
TB7252883Z
TB7252415E

Comment 3

[Jonas Jørgensen]

A crash bug related to position:absolute was fixed recently... could you try the
latest build? ftp://ftp.mozilla.org/pub/mozilla/nightly/latest-trunk

Comment 4

[Brian Rogers]

The date on the latest win32 build was June 14, so I just checked out the latest
source and built it.  The crash still occurs.  Jonas, did you try the testcase?

Comment 5

[M.J.G.]

Confirmed on Linux RedHat 7.2
Mozilla 1.1a Seamonkey build

page displays, infinity sign shows.
crash when leaving the page (back button)

Comment 6

[Jonas Jørgensen]

--> MathML; confirming.

Comment 7

[Jonas Jørgensen]

Confirming.

Comment 8

[Jonas Jørgensen]

Filed bug 152301 on the regression that the "and confirm bug" checkbox no longer
works.

Now attempting to confirm this bug using the "Confirm bug" radio button...

Comment 9

[Jonas Jørgensen]

Ah, that worked :-)

Comment 10

[Brian Rogers]

M.J.G. saw this on Linux.  Setting OS/Platform to All.

Comment 11

[rbs]

Attachment: fix - it is the placeholder frame that is added to flow, not the positionned frame

(The frame construction code isn't one of the prettiest area of Gecko.
Hopefully someday, a shake-up could eliminate these duplicate codes that are
out-of sync.)

Comment 12

[rbs]

Cc:ing roc & waterson for r/sr.

Comment 13

[rbs]

Comment on attachment 88037 [details] [diff] [review]
fix - it is the placeholder frame that is added to flow, not the positionned frame

For the record, this is in an if-def MOZ_MATHML section. So no risk that it
will regress anything. Also BTW, <math> is not expected to support such things
anyway. It already has enough worries of its own and users can achieve	extra
effects by wrapping their math into a <div> and playing with that. For example,
doing a floated/fixed-positioned numerator in a fraction wouldn't make much
sense.
But in this context, avoiding the crash with the fix is worth it.

Comment 14

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 88037 [details] [diff] [review]
fix - it is the placeholder frame that is added to flow, not the positionned frame

r=roc+moz

Comment 15

[Chris Waterson]

Comment on attachment 88037 [details] [diff] [review]
fix - it is the placeholder frame that is added to flow, not the positionned frame

sr=waterson

Comment 16

[rbs]

Resolving as FIXED - was checked in to trunk on 2002-07-08.

Comment 17

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 18

[rbs]

checked in to branch - marking as fixed1.0.1

Comment 19

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/54417ebbaea2