Closed Bug 322820 Opened 19 years ago Closed 19 years ago

Crash [@ nsCSSFrameConstructor::RemoveFirstLetterFrames] with evil testcase, using float:right; and .u::first-letter

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.9alpha1

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

References

(
URL
)

Details

(Keywords: crash, regression, testcase)

Crash Data

This is split of from bug 318592, see bug 318592, comment 10 and further. The url makes Mozilla crash on load. Doesn't crash in 2005-03-22 build, crashes in 2005-02-23 build. Maybe regression from bug 263825? Talkback data from TB12496055E: nsCSSFrameConstructor::RemoveFirstLetterFrames [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12779] nsCSSFrameConstructor::RemoveLetterFrames [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12845] nsCSSFrameConstructor::ContentRemoved [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9814] nsCSSFrameConstructor::ReinsertContent [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9492] PresShell::CharacterDataChanged [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5398] nsGenericDOMDataNode::SetData [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 354] nsCommentNode::SetData [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsCommentNode.cpp, line 59] nsHTMLFormElement::AddRef 0xf9a8e918
This is actually fixed by the patch in bug 317275
Depends on: 317275
Assignee: nobody → bzbarsky
Fixed by checkin for bug 317275
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9alpha
Verified fixed, using latest nightly trunk build.
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsCSSFrameConstructor::RemoveFirstLetterFrames]
You need to log in before you can comment on or make changes to this bug.