325024 - Crash with evil testcase, using object, display: table-column, etc

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase.
It crashes current Mozilla trunk build. It doesn't crash Mozilla1.7, so seems like a regression (Ria, could you find the regression range?)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes on load)

Comment 2

[Martijn Wargers (dead)]

Attachment: backtrace

This is a backtrace from the assertion I get:
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file c:/mozill
a/mozilla/layout/generic/nsPlaceholderFrame.h, line 121

and from the actual crash:
Program received signal SIGSEGV, Segmentation fault.
0x0573b1f6 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574
574         NS_ASSERTION(mStyleContext, "No style context found!");
Current language:  auto; currently c++
(gdb) bt
#0  0x0573b1f6 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574
#1  0x0573b415 in nsIFrame::GetStyleDisplay() const (this=0x0)
    at c:/mozilla/mozilla/layout/style/nsStyleStructList.h:90
#2  0x0501bca1 in nsLayoutUtils::GetFloatFromPlaceholder(nsIFrame*) (
    aFrame=0x1031ba44) at c:/mozilla/mozilla/layout/base/nsLayoutUtils.cpp:186
#3  0x050ada43 in nsLineLayout::ReflowFrame(nsIFrame*, unsigned&, nsHTMLReflowMe
trics*, int&) (this=0x22d768, aFrame=0x1031ba44, aReflowStatus=@0x22d678,
    aMetrics=0x0, aPushedFrame=@0x22d304)
    at c:/mozilla/mozilla/layout/generic/nsLineLayout.cpp:1009

Comment 3

[Martijn Wargers (dead)]

I'm using some table display types here, so Bernd may be interested.

Comment 4

[Martijn Wargers (dead)]

Sorry, this is probably the same as bug 322678.

Comment 5

[Ria Klaassen (not reading all bugmail)]

1.9a1_2006012609 works
1.9a1_2006012621 crashes

Don't know if it's terrible but I can't tripleclick -> select the line:
"This is a searchable index. Enter search keywords:".

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed by patch in bug 322678.

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060209 Firefox/1.6a1