265583 - Crash [@nsCSSFrameConstructor::GetFrame]

Status: VERIFIED DUPLICATE of bug 265181

(Core :: Layout, defect)

Description

[Peter Weilbacher]

Mozilla/5.0 (OS/2; U; Warp 4.5; en-US; rv:1.8a5) Gecko/20041021

When running the Zalewski cgi test program I discovered a reproducible crash
with a garbage HTML file that I will attach shortly. The OS/2 debugger tells me
that it is in nsCSSFrameConstructor::GetFrame in the line
   return frame->GetContentInsertionFrame();
While the crash is not specific to OS/2 or the trunk (I can reproduce it with
1.7.3 on OS/2 and with 1.7.3 on Linux) I didn't create a debug build for Linux
yet and I don't have talkback.

Perhaps there is security involved...

Comment 1

[Peter Weilbacher]

Attachment: testcase

The garbled HTML as created by the Zalewski test program

Comment 2

[Ben Bucksch (:BenB)]

Confirmed on Linux with Mozilla 1.7.?

Comment 3

[Jan Van Looy]

confirmed, winxp, firefox 0.10.1

Comment 4

[Johan Zackrisson]

TB1456593G

Comment 5

[Bernd]

the patch in bug 265181 fixes this crash

Comment 6

[Peter Weilbacher]

Can someone please confirm that the patch to bug 265404 fixed this? Cannot
reproduce any more, so from my point of view this can be resolved.

Comment 7

[Boris Zbarsky [:bzbarsky]]

*** This bug has been marked as a duplicate of 265181 ***