285212 - Crash [@ nsFrameList::PullFrame ] locally [@ nsHTMLReflowState::ComputePadding ] remotely

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Robert Strong (they/them - no direct email)]

The soon to be attached simplified testcase causes a crash @
nsFrameList::PullFrame. I thought I had filed this previously but I could not
find a bug for nsFrameList::PullFrame

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4184569M

Comment 1

[Robert Strong (they/them - no direct email)]

Attachment: testcase (causes crash)

Comment 2

[Robert Strong (they/them - no direct email)]

I suspect this may be a dupe of or related to bug 268157 since I get a crash @
nsHTMLReflowState::ComputePadding when viewing it from bugzilla even though I
get a crash @ nsFrameList::PullFrame when viewing it locally. I tried viewing
the original testcase from bug 268157 locally and still got a crash @
nsHTMLReflowState::ComputePadding so they may very well be different bugs.

This is the talkback when viewing the attachment
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4187221Z

Comment 3

[Robert Strong (they/them - no direct email)]

bug 268157 no longer crashes for me though it may be related while this testcase
still does. I have added an URL of http://exchangecode.com/crashbugs/285212.html
which contains the original testcase and two additional testcases that I have
not reported due to believing these are probably this same bug. Each testcase is
URL encoded in the page itself. These all crash for me with winxp pro sp2 and
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050326.

Comment 4

[Caleb]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050620
Firefox/1.0+ ID:2005062003

I can still see this crash. Requesting blocking.

Comment 5

[Sébastien Auger]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051121 Firefox/1.5

still crashing

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed by checkin for bug 11011 (which removed SplitToContainingBlock).

Comment 7

[Bob Clary [:bc] (inactive)]

layout/base/crashtests/285212-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3