316504 - Crash on bad box element [@nsHTMLReflowState::CalculateHypotheticalBox]

Status: RESOLVED DUPLICATE of bug 253479

(Core :: Layout, defect)

Description

[Michael Wu]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8) Gecko/20051107 Firefox/1.5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8) Gecko/20051107 Firefox/1.5

An XUL box styled with "position:fixed; top:auto; bottom:auto;" crashes firefox.

Reproducible: Always

Steps to Reproduce:
Load any XUL file containing an XUL box as described above.

Comment 1

[Michael Wu]

Attachment: XUL testcase w/ evil box

Comment 2

[Martijn Wargers (dead)]

Sounds like bug 253479, not?

Comment 3

[Michael Wu]

Attachment: Simpler XUL testcase w/ evil box

Comment 4

[Michael Wu]

(In reply to comment #2)
> Sounds like bug 253479, not?
> 

That bug seems to only affect fixed non-xul elements. This affects an xul box when style is set to "position:fixed; top:auto;". (turns out adding bottom:auto isn't necessary to crash)

Comment 5

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051112 SeaMonkey/1.5a Talkback ID: TB11885843E

Comment 6

[Hermann Schwab]

TB11885843E  Stack Signature	 nsHTMLReflowState::CalculateHypotheticalBox
similar stacktrace in Linux Bug 284228 comment1
Bug 284228 Crash with absolute positioning of link toolbar

TB11885843E:
nsHTMLReflowState::CalculateHypotheticalBox  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 893]
nsHTMLReflowState::InitAbsoluteConstraints  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1067]
nsHTMLReflowState::InitConstraints  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1965]
nsHTMLReflowState::Init  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 342]
nsHTMLReflowState::nsHTMLReflowState  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 315]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp, line 521]
nsAbsoluteContainingBlock::Reflow  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp, line 208]
ViewportFrame::Reflow  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsViewportFrame.cpp, line 290]
PresShell::InitialReflow  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 2761]
nsXULDocument::StartLayout  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2059]
nsXULDocument::ResumeWalk  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3085]
nsXULDocument::EndLoad  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp, line 745]
XULContentSinkImpl::DidBuildModel  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULContentSink.cpp, line 407]

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The summary of bug 253479 was not an accurate description of the conditions causing the crash.  I've corrected it.

*** This bug has been marked as a duplicate of 253479 ***