281333 - Crash [@ nsFrameItems::AddChild ] w/ NOFRAMES display:table-header-group; clear:inherit;

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Robert Strong (they/them - no direct email)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050204 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050204 Firefox/1.0+

The soon to be attached simplified testcase causes a crash @
nsFrameItems::AddChild.
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3519650E

Reproducible: Always

Steps to Reproduce:
1. open testcase
2.
3.

Actual Results:  
crash

Expected Results:  
no crash

Testcase contains
<NOFRAMES STYLE="display:table-header-group; clear:inherit;"></NOFRAMES>

Comment 1

[Robert Strong (they/them - no direct email)]

Attachment: Testcase (will cause crash)

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is basically the same as bug 266222 -- it's crashing for the same reasons.

Comment 3

[Robert Strong (they/them - no direct email)]

Fixed with the checkin for bug 240129 and verified with a beast buid. Thanks bernd!

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; no crash here using the testcase of
https://bugzilla.mozilla.org/attachment.cgi?id=173588 with Mozilla/5.0 (Windows;
U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050304.

Comment 5

[Bob Clary [:bc] (inactive)]

layout/base/crashtests/281333-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3