281527 - Evil testcase causes crash, using td:hover, tbody:hover{display:table-caption;} [@ nsTableRowFrame::InsertFrames] [@ nsTableRowFrame::AppendFrames]

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

This might be related to bug 280009.

The upcoming testcase causes a crash when hovering a few times over the select
box (with "About" in it inside).
It is also crashing in Mozilla1.4, so this is not a (recent) regression.

Comment 1

[Martijn Wargers (dead)]

Attachment: Testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: Testcase2

While trying to minimise further, I found this.
Every time when hovering over the text, the text gets doubled.
Maybe this is the initial cause of the crash?

Comment 3

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050208
crash with stack signature nsTableRowFrame::InsertFrames

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3570763X
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTableRowFrame%3A%3AInsertFrames+&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

same signature found in 
Bug 281173 chance of crash [@ nsScrollPortView::IncrementalScroll][@
nsScrollPortView::Paint] when scrolling on this page, only with smooth scrolling
enabled

Comment 4

[Tobias Fischer]

While reproducing the crash from Testcase 1 I got TB3570613M with Signature:

nsTableRowFrame::AppendFrames  which is a little different from TB-Incident at
Comment #3

Comment 5

[Andrew Schultz]

Attachment: simpler testcase

crashes on load with linux trunk 2005021105

Comment 6

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050213
JS disabled, this time I crashed with Stack Signature 	
nsTableRowFrame::AppendFrames

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3687246K

I didn´t succeed crashing with the linux crashing testcase from comment 3

AppendFrames/InsertFrames   4 talkbacks each one:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTableRowFrame%3A%3AAppendFrames&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTableRowFrame%3A%3AInsertFrames&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Comment 7

[Bernd]

Attachment: testcase without script

the testcase allready asserts like hell without the script.

###!!! ASSERTION: program error: 'PR_FALSE', file
e:/moz_src/mozilla/layout/base
/nsCSSFrameConstructor.cpp, line 1422
###!!! ASSERTION: unable to find table parent. aTableFrame null.:
'nsnull!=aTabl
eFrame', file e:/moz_src/mozilla/layout/tables/nsTableFrame.cpp, line 4090
###!!! ASSERTION: unable to find table parent. result!=NS_OK: 'NS_OK==rv', file

e:/moz_src/mozilla/layout/tables/nsTableFrame.cpp, line 4091
WARNING: Reflow of frame failed in nsLineLayout, file
e:/moz_src/mozilla/layout/
generic/nsLineLayout.cpp, line 1000
###!!! ASSERTION: reflow dirty lines failed: 'NS_SUCCEEDED(rv)', file
e:/moz_src
/mozilla/layout/generic/nsBlockFrame.cpp, line 819
Document file:///C:/temp/bug281527noscript.html loaded successfully

Comment 8

[Bernd]

Attachment: patch

Comment 9

[Bernd]

this has nothing to do with bug 280009 removing dependency

Comment 10

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 175659 [details] [diff] [review]
patch

r+sr=bzbarsky

Comment 11

[Bernd]

fix checked in

Comment 12

[Stephen Donner [:stephend] Not actively reading bugmail]

None of the testcases in this bug crash now using Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050304 on Windows XP.

Verified FIXED.

Comment 13

[Martijn Wargers (dead)]

Ok, this is fixed. Should I file a new bug on testcase2 in comment 2, though? I
don't think that is really normal.

Comment 14

[Boris Zbarsky [:bzbarsky]]

If that's not fixed, then please do file a bug on it (cc me and bernd).

Comment 15

[Martijn Wargers (dead)]

Ok, I filed bug 286143 for it.