317876 - Crash with evil testcase on hovering after reload with display:table-row, display:inherit

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase.

To reproduce the crash:
- Load testcase
- Hover over the text
- Reload
- Hover over the text
- Reload

Also happens in Mozilla1.7

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: backtrace from debug build

Backtrace from debug build, from the assertion I get.
It doesn't seem to crash in a debug build, though.

Comment 3

[Bernd]

The display type asserts are the debug help patch from bug 289517 that got checked in without r/sr.

Comment 4

[Bernd]

fixed by the checkin for bug 289517

Comment 5

[Bernd]

reading the bug sometimes helps :-(

Comment 6

[Boris Zbarsky [:bzbarsky]]

So is this still an issue now that bug 289517 is fixed?

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #6)
> So is this still an issue now that bug 289517 is fixed?

Not with 2005-12-22-10 of trunk SeaMonkey on Windows XP, no.

Comment 8

[Bernd]

Stephen did you see comments 4 and 5, I reopened because I first believed that it got fixed and later discovered that is not the case, You have to reload the testcase as the bug description says: TB13223205Z

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #8)
> Stephen did you see comments 4 and 5, I reopened because I first believed that
> it got fixed and later discovered that is not the case, You have to reload the
> testcase as the bug description says: TB13223205Z

Bernd, yes indeed that's the case.  Sorry ;-(

It took a while--I had to browse away from the page to get it to crash, but I did.

Comment 10

[Bernd]

The style display resolution is still wrong even after the patch for bug 289517.

Comment 11

[Bernd]

Attachment: frames and their style contexts

Comment 12

[Bernd]

Undoing https://bugzilla.mozilla.org/show_bug.cgi?id=289517#c27 fixes the assert and the crash. So from my reading of bug 289517 we need to fix the static case first to get the patch back in. But is static the right word here? Don't we need to fix the ordinary table cell creation aka bug 323656?

Comment 13

[Bernd]

Boris, could you provide some guidance for this?

Comment 14

[Boris Zbarsky [:bzbarsky]]

Yeah, the static case is bug 323656.

Could we perhaps do something for branch where we skip over the parent cellContent if and only if its parent is a pseudo-cell?  That shouldn't cause the sorts of issues bug 289517 comment 26 talks about, at least.

For trunk, we should fix bug 323656 and possibly in general fix how we determine our parent style context...

Comment 15

[Boris Zbarsky [:bzbarsky]]

Now that bug bug 323656 is fixed, is this still a problem?

Comment 16

[Yani (fr)]

no more crash

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070416 Minefield/3.0a4pre ID:2007041607 [cairo]

Comment 17

[Martijn Wargers (dead)]

Yes, seems fixed, no crash on reload anymore, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070417 Minefield/3.0a4pre

Comment 18

[Martijn Wargers (dead)]

Verified fixed on trunk and branches.
The testcase doesn't crash anymore when hovering over the text and then reloading.

Comment 19

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/96fb5890382c

Comment 20

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/96fb5890382c