325434 - Crash with evil xul testcase, using a lot of display:table-* rules [@ nsBoxLayoutState::Unwind]

Status: VERIFIED WORKSFORME

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes Mozilla on load.
It also crashes Mozilla1.7, so no recent regression.
Bernd, I'm using lots of table-displays here ;)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes on load)

Talkback ID: TB14616291H

Comment 2

[Martijn Wargers (dead)]

From Talkback ID:
nsBoxLayoutState::Unwind  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxLayoutState.cpp, line 183]
nsBoxLayoutState::Unwind  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxLayoutState.cpp, line 159]
nsBoxLayoutState::HandleReflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxLayoutState.cpp, line 114]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 217]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 742]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 239]
IncrementalReflow::Dispatch  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 861]
PresShell::ProcessReflowCommands  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6502]
ReflowEvent::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6326]
HandlePLEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 6344]
SHELL32.dll + 0x520c24 (0x778b0c24)

Comment 3

[Bernd]

<conditions id="a" style="display: table;">
  <vbox style="display: table-row;">
    <rows style="display: table-column;"></rows>

    <box style="display: table-row;">
      <resizer id="b" style="display: inline;"></resizer>
    </box>

    <box style="display: table-column-group;"></box>
  </vbox>
</conditions>

ROFL

Comment 4

[Bernd]

The debugger on winxp dies at 

IncrementalReflow::AddCommand(nsPresContext * 0x036ec958, nsHTMLReflowCommand * 0x036b3a60) line 896 + 27 bytes
PresShell::ProcessReflowCommands(int 1) line 6472 + 26 bytes
ReflowEvent::HandleEvent() line 6326
HandlePLEvent(PLEvent * 0x036b3720) line 6344
PL_HandleEvent(PLEvent * 0x036b3720) line 688 + 9 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0101a1f8) line 623 + 8 bytes
_md_EventReceiverProc(HWND__ * 0x000404ae, unsigned int 49386, unsigned int 0, long 16884216) line 1408 + 8 bytes
USER32! 77d18734()
USER32! 77d18816()
USER32! 77d189cd()
USER32! 77d18a10()
nsAppShell::Run(nsAppShell * const 0x02184958) line 135
nsAppStartup::Run(nsAppStartup * const 0x021848b8) line 161 + 74 bytes
XRE_main(int 3, char * * 0x003b7180, const nsXREAppData * 0x00403020 kAppData) line 2321 + 34 bytes
main(int 3, char * * 0x003b7180) line 61 + 17 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 7c816d4f()

at
  if (rootFrame->GetParent() &&

where the fields of  rootframe are already dead aka 0xdddddd

Comment 5

[Bernd]

This is WFM with my debug build with the patch for bug 325984, it might work already on trunk.

Comment 6

[Martijn Wargers (dead)]

Yeah, this is already wfm with current trunk build.
I see I used a display: table-column-group; rule in the testcase, so probably fixed by the bug that fixed display: table-column-group;.