Crash with evil testcase, using object, display: table-column, etc

VERIFIED FIXED in mozilla1.9alpha1

Status

()

defect
--
critical
VERIFIED FIXED
14 years ago
4 months ago

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

Tracking

({crash, regression, testcase})

Trunk
mozilla1.9alpha1
x86
Windows XP
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

See upcoming testcase.
It crashes current Mozilla trunk build. It doesn't crash Mozilla1.7, so seems like a regression (Ria, could you find the regression range?)
Posted file backtrace
This is a backtrace from the assertion I get:
###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file c:/mozill
a/mozilla/layout/generic/nsPlaceholderFrame.h, line 121

and from the actual crash:
Program received signal SIGSEGV, Segmentation fault.
0x0573b1f6 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574
574         NS_ASSERTION(mStyleContext, "No style context found!");
Current language:  auto; currently c++
(gdb) bt
#0  0x0573b1f6 in nsIFrame::GetStyleData(nsStyleStructID) const (this=0x0,
    aSID=eStyleStruct_Display)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:574
#1  0x0573b415 in nsIFrame::GetStyleDisplay() const (this=0x0)
    at c:/mozilla/mozilla/layout/style/nsStyleStructList.h:90
#2  0x0501bca1 in nsLayoutUtils::GetFloatFromPlaceholder(nsIFrame*) (
    aFrame=0x1031ba44) at c:/mozilla/mozilla/layout/base/nsLayoutUtils.cpp:186
#3  0x050ada43 in nsLineLayout::ReflowFrame(nsIFrame*, unsigned&, nsHTMLReflowMe
trics*, int&) (this=0x22d768, aFrame=0x1031ba44, aReflowStatus=@0x22d678,
    aMetrics=0x0, aPushedFrame=@0x22d304)
    at c:/mozilla/mozilla/layout/generic/nsLineLayout.cpp:1009
I'm using some table display types here, so Bernd may be interested.
Sorry, this is probably the same as bug 322678.
Depends on: 322678
1.9a1_2006012609 works
1.9a1_2006012621 crashes

Don't know if it's terrible but I can't tripleclick -> select the line:
"This is a searchable index. Enter search keywords:".
Fixed by patch in bug 322678.
Assignee: nobody → bzbarsky
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9alpha
Verified FIXED using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060209 Firefox/1.6a1
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.