251914 - crash with CSS: html { display: table } body { position: fixed }

Status: VERIFIED DUPLICATE of bug 231776

(Core :: Layout, defect)

Description

[Simon Budig]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8

The following CSS snipped crashes mozilla
html {
  display: table;
}

body {
  position: fixed;
}

While the copy I discovered this on is not very recent, friends report that this
happens as well with fairly recent CVS-builds.

I am not sure if this is "proper" use of CSS, however, mozilla should not crash.

Reproducible: Always
Steps to Reproduce:
1. Load http://www.home.unix-ag.org/simon/files/mozilla-crash.html
2. watch mozilla die.




The crash happens at least with mozilla, firefox and epiphany.

Quoting Akkana Peck: "It's in nsIFrame::GetView called from
nsHTMLContainerFrame::CreateViewForFrame."

Comment 1

[Simon Budig]

Attachment: testcase - will crash mozilla!

This is the testcase again, pasted as attachment since the URL will not be
valid forever...

Comment 2

[Akkana Peck]

Confirming: I see this in 1.7 and in a more recent build.  Sounds related to bug
230138, but that was marked fixed as of february.

Comment 3

[Boris Zbarsky [:bzbarsky]]

*** This bug has been marked as a duplicate of 231776 ***

Comment 4

[Alex Hirzel]

v