Closed
Bug 317854
Opened 19 years ago
Closed 19 years ago
Crash in [@ 0x00cd0003 DeletingFrameSubtree] with evil testcase using display:table-cell and a lot of position:absolute
Categories
(Core :: Layout, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: martijn.martijn, Assigned: MatsPalmgren_bugz)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(1 file)
|
572 bytes,
text/html
|
Details |
See upcoming testcase.
Mozilla crashes when hovering over the text.
Doesn't happen in Mozilla1.7.
Talkback ID: TB12271402Q
0x00cd0003
DeletingFrameSubtree [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9732]
nsCSSFrameConstructor::ContentRemoved [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9883]
nsCSSFrameConstructor::RecreateFramesForContent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11495]
nsCSSFrameConstructor::RestyleElement [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10377]
nsCSSFrameConstructor::ProcessOneRestyle [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13211]
nsCSSFrameConstructor::ProcessPendingRestyles [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13259]
nsCSSFrameConstructor::RestyleEvent::HandleEvent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13324]
SHELL32.dll + 0x520c24 (0x778b0c24)
|
Reporter | |
Comment 1•19 years ago
|
||
|
||
Comment 2•19 years ago
|
||
Does the patch in bug 310638 help here? It seems like it should...
Depends on: 310638
|
||
Updated•19 years ago
|
Summary: Crash with evil testcase using display:table-cell and a lot of position:absolute → Crash in [@ 0x00cd0003 DeletingFrameSubtree] with evil testcase using display:table-cell and a lot of position:absolute
|
|
Reporter | |
Updated•19 years ago
|
Blocks: ajax-demolisher
|
|
Reporter | |
Comment 4•19 years ago
|
||
Yes, the patch in bug 310638 fixes the crash.
|
||
Comment 5•19 years ago
|
||
I can repro in today's nightly build, but not in a later hourly build from atlantia (with the patch for bug 310638). -> FIXED.
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
|
Assignee | |
Updated•19 years ago
|
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
|
|
Assignee | |
Updated•19 years ago
|
Assignee: nobody → mats.palmgren
Status: REOPENED → NEW
|
|
Assignee | |
Updated•19 years ago
|
Status: NEW → RESOLVED
Closed: 19 years ago → 19 years ago
Resolution: --- → FIXED
|
|
||
Comment 6•19 years ago
|
||
Verified FIXED using builds:
SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060127 Mozilla/1.0 and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060127 Firefox/1.6a1
on the testcase URL: https://bugzilla.mozilla.org/attachment.cgi?id=204215
no crash.
Status: RESOLVED → VERIFIED
|
||
Updated•13 years ago
|
Crash Signature: [@ 0x00cd0003 DeletingFrameSubtree]
You need to log in
before you can comment on or make changes to this bug.
Description
•