277062 - crash in nsRuleNode.h:210

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Alexander Opitz]

Crash result from a mangled html.

#7  0x41c0aa15 in nsProfileLock::FatalSignalHandler (signo=11) at
    nsProfileLock.cpp:209
#8  <signal handler called>
#9  nsCachedStyleData::GetStyleData (this=0xddddddfd, aSID=@0x4174c6f0)
    at nsRuleNode.h:210

Comment 1

[Alexander Opitz]

Attachment: mangled file

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(gdb) frame 11
#11 0x01c141ea in BasicTableLayoutStrategy::AssignNonPctColumnWidths (
    this=0x9308ff8, aMaxWidth=12408, aReflowState=@0xbff8b5d0)
    at /builds/trunk/mozilla/layout/tables/BasicTableLayoutStrategy.cpp:1082
1082        nsStyleCoord colStyleWidth = colFrame->GetStyleWidth();
(gdb) p *colFrame
$4 = {<nsFrame> = {<nsBox> = {<nsIFrame> = {<nsISupports> = {
          _vptr.nsISupports = 0x0}, mRect = {x = -572662307, y = -572662307,   
       width = -572662307, height = -572662307}, mContent = 0xdddddddd,
        mStyleContext = 0xdddddddd, mParent = 0xdddddddd,         mNextSibling =
0xdddddddd, mState = 3722304989}, static gGotTheme = 1,
      static gTheme = 0x8e650a8}, <nsIFrameDebug> = {<nsISupports> = {        
_vptr.nsISupports = 0xdddddddd}, <No data fields>}, <No data fields>},
  mColIndex = 56797, mLeftBorderWidth = 221 '\uffff', mRightBorderWidth = 221
'\uffff',
  mTopContBorderWidth = 221 '\uffff', mRightContBorderWidth = 221 '\uffff',  
mBottomContBorderWidth = 221 '\uffff', mWidths = {0, 0, -1, -1, -1, -1, -1, -1,
    -1, -1}}


Layout getting a style context from a deleted frame doesn't make it a CSS bug.

Comment 3

[Bernd]

as dbaron said the colframe is gone already

Comment 4

[Mats Palmgren (inactive)]

Attachment: Testcase #2

Comment 5

[Bernd]

Attachment: patch

1) see symmetry with InsertRowGroups
2) if we omit the second flag we tell to insert this frame and all siblings
that are not null, that means we insert already existing frames (in this case
the previously existing anonymous colgroup frame.
3) before the previous patch, this code got never 2 colgroups as we did not
create them in the CSSFrameConstructor (the typical one patch reveals several
other problems)

Comment 6

[Bernd]

and it fixes the dependent bug

Comment 7

[Bernd]

Attachment: debug code

debug code that I needed to find the f

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 172885 [details] [diff] [review]
patch

r+sr=bzbarsky

Comment 9

[Boris Zbarsky [:bzbarsky]]

And add the testcase to the regression tests?

Comment 10

[Bernd]

fix and testcases checked in

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using the testcase
https://bugzilla.mozilla.org/attachment.cgi?id=170330 on a Windows XP trunk
2005-02-12-05 Seamonkey build.

Comment 12

[Bob Clary [:bc] (inactive)]

layout/tables/crashtests/277062-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3