Closed Bug 281527 Opened 20 years ago Closed 20 years ago

Evil testcase causes crash, using td:hover, tbody:hover{display:table-caption;} [@ nsTableRowFrame::InsertFrames] [@ nsTableRowFrame::AppendFrames]

Categories

(Core :: Layout: Tables, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: bernd_mozilla)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(5 files)

This might be related to bug 280009.

The upcoming testcase causes a crash when hovering a few times over the select
box (with "About" in it inside).
It is also crashing in Mozilla1.4, so this is not a (recent) regression.
Attached file Testcase
Attached file Testcase2
While trying to minimise further, I found this.
Every time when hovering over the text, the text gets doubled.
Maybe this is the initial cause of the crash?
Depends on: 280009
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050208
crash with stack signature nsTableRowFrame::InsertFrames

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3570763X
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsTableRowFrame%3A%3AInsertFrames+&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

same signature found in 
Bug 281173 chance of crash [@ nsScrollPortView::IncrementalScroll][@
nsScrollPortView::Paint] when scrolling on this page, only with smooth scrolling
enabled
While reproducing the crash from Testcase 1 I got TB3570613M with Signature:

nsTableRowFrame::AppendFrames  which is a little different from TB-Incident at
Comment #3
Keywords: testcase
Summary: Evil testcase causes crash, using td:hover, tbody:hover{display:table-caption;} → Evil testcase causes crash, using td:hover, tbody:hover{display:table-caption;} [@ nsTableRowFrame::InsertFrames] [@ nsTableRowFrame::AppendFrames]
Attached file simpler testcase
crashes on load with linux trunk 2005021105
the testcase allready asserts like hell without the script.

###!!! ASSERTION: program error: 'PR_FALSE', file
e:/moz_src/mozilla/layout/base
/nsCSSFrameConstructor.cpp, line 1422
###!!! ASSERTION: unable to find table parent. aTableFrame null.:
'nsnull!=aTabl
eFrame', file e:/moz_src/mozilla/layout/tables/nsTableFrame.cpp, line 4090
###!!! ASSERTION: unable to find table parent. result!=NS_OK: 'NS_OK==rv', file

e:/moz_src/mozilla/layout/tables/nsTableFrame.cpp, line 4091
WARNING: Reflow of frame failed in nsLineLayout, file
e:/moz_src/mozilla/layout/
generic/nsLineLayout.cpp, line 1000
###!!! ASSERTION: reflow dirty lines failed: 'NS_SUCCEEDED(rv)', file
e:/moz_src
/mozilla/layout/generic/nsBlockFrame.cpp, line 819
Document file:///C:/temp/bug281527noscript.html loaded successfully
Attachment #175354 - Attachment description: testcase withoout script → testcase without script
Attached patch patchSplinter Review
Assignee: nobody → bernd_mozilla
Status: NEW → ASSIGNED
this has nothing to do with bug 280009 removing dependency
No longer depends on: 280009
Attachment #175659 - Flags: superreview?(bzbarsky)
Attachment #175659 - Flags: review?(bzbarsky)
Comment on attachment 175659 [details] [diff] [review]
patch

r+sr=bzbarsky
Attachment #175659 - Flags: superreview?(bzbarsky)
Attachment #175659 - Flags: superreview+
Attachment #175659 - Flags: review?(bzbarsky)
Attachment #175659 - Flags: review+
fix checked in
Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
None of the testcases in this bug crash now using Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050304 on Windows XP.

Verified FIXED.
Status: RESOLVED → VERIFIED
Ok, this is fixed. Should I file a new bug on testcase2 in comment 2, though? I
don't think that is really normal.
If that's not fixed, then please do file a bug on it (cc me and bernd).
Ok, I filed bug 286143 for it.
Crash Signature: [@ nsTableRowFrame::InsertFrames] [@ nsTableRowFrame::AppendFrames]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: