267039 - Crash [@ nsFrameList::DestroyFrames] on page teardown when float inserted into legend via DOM

Status: RESOLVED DUPLICATE of bug 267037

(Core :: Layout: Form Controls, defect)

Description

[Boris Zbarsky [:bzbarsky]]

If I insert a float as a child of a legend via the DOM, we crash when tearing
down the page in a currentish (pulled at "Wed Oct 27 11:38:32 CDT 2004") debug
build and in a 2004-10-31 nightly.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

The problem is that when we go to destroy the frames in the legend frame's
float list, they are already 0xdddddddd.  I'm not quite sure where it gets
destroyed, but presumably it ends up in two different float lists or something
silly like that....

Comment 2

[Ian Graham]

Attachment also crashes current Firefox 1.0 PR on Windows XP: 
Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1

Changed OS to all.

Talkback TB1638737Q

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This is fixed by my patch in bug 267037

*** This bug has been marked as a duplicate of 267037 ***