18359 - This page causes crash in nsTableCellFrame

Status: VERIFIED WORKSFORME

(Core :: Layout: Tables, defect, P3)

Description

[Bill Law]

I tried to go to the referenced page (I've got a bug that requires doing so) and
it now crashes the browser.  I worked on Friday.

Comment 1

[Bill Law]

Forgot the stack trace:

nsCellMap::GetCellInfoAt(int 0x00000001, int 0x00000001, int * 0x0012d818, int *
0x0012d81c) line 515 + 16 bytes
nsTableFrame::GetCellInfoAt(int 0x00000001, int 0x00000001, int * 0x0012d818,
int * 0x0012d81c) line 4082
BasicTableLayoutStrategy::AssignPreliminaryColumnWidths(int 0x00002724) line 742
+ 30 bytes
BasicTableLayoutStrategy::Initialize(nsSize * 0x00000000, int 0x00000003, int
0x00002724) line 112
nsTableFrame::BalanceColumnWidths(nsIPresContext & {...}, const
nsHTMLReflowState & {...}, const nsSize & {...}, nsSize * 0x00000000) line 2882
nsTableFrame::Reflow(nsTableFrame * const 0x028cb590, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 1291
nsContainerFrame::ReflowChild(nsIFrame * 0x028cb590, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 405 + 31 bytes
nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x028cb660, nsIPresContext &
{...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned
int & 0x00000000) line 900 + 34 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x028cb660, const nsRect & {...},
int 0x00000000, int 0x00000000, int 0x00000001, nsMargin & {...}, unsigned int &
0x00000000) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x029bdf30, int * 0x0012e174) line 3226 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x029bdf30, int
* 0x0012e174, int 0x00000000) line 2614 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2425 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x0344b7c0, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 1489 + 15 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x0344b7c0, const nsRect & {...},
int 0x00000001, int 0x00000000, int 0x00000000, nsMargin & {...}, unsigned int &
0x00000000) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x029bde40, int * 0x0012ea10) line 3226 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x029bde40, int
* 0x0012ea10, int 0x00000001) line 2614 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2425 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x03429400, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 1489 + 15 bytes
nsBlockReflowContext::ReflowBlock(nsIFrame * 0x03429400, const nsRect & {...},
int 0x00000001, int 0x00000000, int 0x00000001, nsMargin & {...}, unsigned int &
0x00000000) line 251 + 45 bytes
nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox *
0x0342bfd0, int * 0x0012f2ac) line 3226 + 59 bytes
nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x0342bfd0, int
* 0x0012f2ac, int 0x00000001) line 2614 + 20 bytes
nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 2425 + 27 bytes
nsBlockFrame::Reflow(nsBlockFrame * const 0x03428480, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 1489 + 15 bytes
nsAreaFrame::Reflow(nsAreaFrame * const 0x03428480, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 289 + 25 bytes
nsContainerFrame::ReflowChild(nsIFrame * 0x03428480, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 405 + 31 bytes
RootFrame::Reflow(RootFrame * const 0x0342d440, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 332
nsContainerFrame::ReflowChild(nsIFrame * 0x0342d440, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 405 + 31 bytes
nsScrollFrame::Reflow(nsScrollFrame * const 0x0342af00, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 621
nsContainerFrame::ReflowChild(nsIFrame * 0x0342af00, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 405 + 31 bytes
ViewportFrame::Reflow(ViewportFrame * const 0x0342d730, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int &
0x00000000) line 514
nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x029bdde0,
nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...},
nsIRenderingContext & {...}) line 140
PresShell::ProcessReflowCommands(PresShell * const 0x033cc5f0) line 1617
ReflowEvent::HandleEvent() line 1526
HandlePLEvent(ReflowEvent * 0x029bbc00) line 1539
PL_HandleEvent(PLEvent * 0x029bbc00) line 537 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01fb3c50) line 498 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x011908d0, unsigned int 0x0000c0ca, unsigned int
0x00000000, long 0x01fb3c50) line 972 + 9 bytes
USER32! 77e713ed()
01fb3c50()

Comment 2

[Jimmy Lee]

Excellent.  I was just about to enter this bug, too.  I crash on Linux and
Win98/Win95.  No crash observed from Macintosh and WinNT.  Also, from Win98, I
can open http://jimbob.mcom.com, click on trigger2.html, and the page loads
without a crash.

Comment 3

[karnaze (gone)]

This was fixed with a checkin from Rod on 11/9.

Comment 4

[Christine Hoffman]

Using 11/16 build, no crash. Verifying fixed.