Closed Bug 316636 Opened 19 years ago Closed 19 years ago

Crash [@ nsRect::nsRect(const nsRect & {...}) line 56]

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
major

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: bc, Assigned: bernd_mozilla)

References

Details

(Keywords: crash, verified1.8.0.1, verified1.8.1, Whiteboard: [sg:nse] null dereference)

Crash Data

Attachments

(2 files)

testcase (WARNING: crashes onload)
499 bytes, text/html
Details
patch
1.66 KB, patch
bzbarsky
: review+
bzbarsky
: superreview+
mtschrep
: approval1.8.0.1+
mtschrep
: approval1.8.1+
Details | Diff | Splinter Review 
More proof this is probably the same as bug 310426, it doesn't crash with 2005-09-20 build, but crashes with 2005-09-21 build (which is the same regression range as bug 310505, which is essentially a dupe of bug 310426).
Depends on: 310426
realCell is null on line 2318 of nsTableFrame.cpp. Adding a null check to the if(realCell != lastCell) line above would stop the crash, but I have no idea if it's the right thing to do: Are null cells something normal this code should be coping with, or is the fact we have a null cell the real problem?
Keywords: crash
Whiteboard: [sg:nse] null dereference
the code is simply wrong, it is seldom executed so its a very old bug
Assignee: nobody → bernd_mozilla
Status: UNCONFIRMED → NEW
No longer depends on: 310426
Ever confirmed: true
Attached patch patch — — Splinter Review 
this makes the code more symmetric to http://lxr.mozilla.org/mozilla/source/layout/tables/nsTableFrame.cpp#2444
Attachment #204294 - Flags: superreview?(bzbarsky)
Attachment #204294 - Flags: review?(bzbarsky)
Attachment #204294 - Flags: superreview?(bzbarsky)
Attachment #204294 - Flags: superreview+
Attachment #204294 - Flags: review?(bzbarsky)
Attachment #204294 - Flags: review+
Fix checked in, Martijn could you please test with a build that has the patch and open a new bug with security flag and a new stacktrace.
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Ok, I filed bug 318451.
Comment on attachment 204294 [details] [diff] [review]
patch

low risk null check, I think its branch worth. if not 1.8.0.1 then 1.8.1( or how you name it) for sure.
Attachment #204294 - Flags: approval1.8.0.1?
Blocks: 318451
Comment on attachment 204294 [details] [diff] [review]
patch

Please land in both 1.8.1 and 1.8.0 branches.
Attachment #204294 - Flags: approval1.8.1+
Attachment #204294 - Flags: approval1.8.0.1?
Attachment #204294 - Flags: approval1.8.0.1+
fixed on branches
Keywords: fixed1.8.0.1, fixed1.8.1
verified the _specified_ crash no longer occurs on windows with 1.8.0.1. Firefox 1.5.0.1 hangs now and requires the process to be killed. Trunk crashes with a newer, uglier stack appears in bug 322704.
Keywords: fixed1.8.0.1 → verified1.8.0.1
verified no crash with the testcase on 1.8.0.1, 1.8.1, 1.9a1 on windows.
Status: RESOLVED → VERIFIED
Flags: testcase?
Keywords: fixed1.8.1 → verified1.8.1
Flags: testcase? → testcase+
Whiteboard: [sg:nse] null dereference → [sg:nse] null dereference. random-styles
Flags: in-testsuite+ → in-testsuite?
Whiteboard: [sg:nse] null dereference. random-styles → [sg:nse] null dereference
Group: security
crash test landed
http://hg.mozilla.org/mozilla-central/rev/4d671f0bafad
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsRect::nsRect(const nsRect & {...}) line 56]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: