Crash on bad box element [@nsHTMLReflowState::CalculateHypotheticalBox]

RESOLVED DUPLICATE of bug 253479

Status

()

--
critical
RESOLVED DUPLICATE of bug 253479
13 years ago
8 years ago

People

(Reporter: altape, Unassigned)

Tracking

({crash, crashreportid, testcase})

Trunk
x86
All
crash, crashreportid, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment, 1 obsolete attachment)

168 bytes, application/vnd.mozilla.xul+xml
Details
(Reporter)

Description

13 years ago
User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8) Gecko/20051107 Firefox/1.5
Build Identifier: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8) Gecko/20051107 Firefox/1.5

An XUL box styled with "position:fixed; top:auto; bottom:auto;" crashes firefox.

Reproducible: Always

Steps to Reproduce:
Load any XUL file containing an XUL box as described above.
(Reporter)

Comment 1

13 years ago
Created attachment 203096 [details]
XUL testcase w/ evil box
Sounds like bug 253479, not?
Component: XP Toolkit/Widgets: XUL → Layout
QA Contact: xptoolkit.xul → layout
(Reporter)

Comment 3

13 years ago
Created attachment 203124 [details]
Simpler XUL testcase w/ evil box
Attachment #203096 - Attachment is obsolete: true
(Reporter)

Comment 4

13 years ago
(In reply to comment #2)
> Sounds like bug 253479, not?
> 

That bug seems to only affect fixed non-xul elements. This affects an xul box when style is set to "position:fixed; top:auto;". (turns out adding bottom:auto isn't necessary to crash)
Keywords: crash

Comment 5

13 years ago
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051112 SeaMonkey/1.5a Talkback ID: TB11885843E
OS: Linux → All

Updated

13 years ago
Keywords: talkbackid

Comment 6

13 years ago
TB11885843E  Stack Signature	 nsHTMLReflowState::CalculateHypotheticalBox
similar stacktrace in Linux Bug 284228 comment1
Bug 284228 Crash with absolute positioning of link toolbar

TB11885843E:
nsHTMLReflowState::CalculateHypotheticalBox  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 893]
nsHTMLReflowState::InitAbsoluteConstraints  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1067]
nsHTMLReflowState::InitConstraints  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1965]
nsHTMLReflowState::Init  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 342]
nsHTMLReflowState::nsHTMLReflowState  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsHTMLReflowState.cpp, line 315]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp, line 521]
nsAbsoluteContainingBlock::Reflow  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp, line 208]
ViewportFrame::Reflow  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/generic/nsViewportFrame.cpp, line 290]
PresShell::InitialReflow  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp, line 2761]
nsXULDocument::StartLayout  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2059]
nsXULDocument::ResumeWalk  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3085]
nsXULDocument::EndLoad  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp, line 745]
XULContentSinkImpl::DidBuildModel  [c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULContentSink.cpp, line 407]
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: Crash on bad box element → Crash on bad box element [@nsHTMLReflowState::CalculateHypotheticalBox]
(Reporter)

Updated

13 years ago
Keywords: testcase

Updated

13 years ago
Blocks: 317502
Depends on: 253479
The summary of bug 253479 was not an accurate description of the conditions causing the crash.  I've corrected it.

*** This bug has been marked as a duplicate of 253479 ***
Status: NEW → RESOLVED
Last Resolved: 13 years ago
No longer depends on: 253479
Resolution: --- → DUPLICATE
Crash Signature: [@nsHTMLReflowState::CalculateHypotheticalBox]
You need to log in before you can comment on or make changes to this bug.