22726 - Crash on page with css2 style sheet selector

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[extremely]

This seems to be related to Layout Parser or Style.  I can't figure out which.
I boiled the page down to a minimum which I will attach to this bug.  When you
look at the attachment, note the css2 style sheet selector syntax.

` .maths + * { clear: both; } '

If one less span tag is used or the <form><select> is removed or the clear:
both; is moved into the ` .maths span {} ' rule the crash doesn't happen.
This leads me to believe that the layout engine can't handle the parse tree
where the <select> flows around the clear added with the css2 rule.

If you add content before the <div> it will display, implying that the parser
makes it past the rule ok.  text after the <select> doesn't display.

I'm PC only this week so I can't verify on linux or get a stack trace.

The browser is M12.  The windows error is "Mozilla caused an nvalid page fault
in module GKHTML.DLL 015f:601ba4af."

Comment 1

[extremely]

Attachment: Bad style selector testcase

Comment 2

[troy]

Fixed by a recent change to the block code Buster made

Comment 3

[Chris Petersen]

With the latest build (2000010308), the crash is not occuring.