329692 - Crash using canvas style display:table-footer-group and font display:table and more

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes on load.

This regressed between 2005-11-30 and 2005-12-15 (Ria, could you minimise the regression period more?)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Talkback ID: TB16069311Q

nsTableRowGroupFrame::GetRowCount   nsTableFrame::GetAscent   nsTableOuterFrame::Reflow   0x0012e584
0x0259bb4c
0x0259b0a8
0x0259af04
0x02585f1c
0x02586064

Comment 2

[Bernd]

no need to reduce the regression window, 
Canvas is tag based frame creation it should be mentioned inside IsSpecialContent.

Comment 3

[Bernd]

Attachment: patch

Comment 4

[Bernd]

Vladimir this is bug/omission in the frame constructor part of the html canvas implementation. EVERY frame where the frame construction is not controlled by the display-type needs to be mentioned in IsSpecialContent otherwise Martijn will sooner or later create a crash testcase for this. Isn't Canvas on the 1.8 branches?

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

(In reply to comment #4)
> Vladimir this is bug/omission in the frame constructor part of the html canvas
> implementation. EVERY frame where the frame construction is not controlled by
> the display-type needs to be mentioned in IsSpecialContent otherwise Martijn
> will sooner or later create a crash testcase for this. Isn't Canvas on the 1.8
> branches?

Sure, I must've missed that part in the new-frame-implementation documentation.  Yes, we should land this on 1.8.0/1.8.1 as well as the trunk.

Comment 6

[Bernd]

Comment on attachment 214399 [details] [diff] [review]
patch

Boris, this are the usual suspects..., (I know we need to rewrite it, but I have no idea how to do it)

Comment 7

[Boris Zbarsky [:bzbarsky]]

> Sure, I must've missed that part in the new-frame-implementation documentation.

Which documentation is that?  Chances are it predates the existence of IsSpecialContent.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 214399 [details] [diff] [review]
patch

r+sr=bzbarsky, and approved for 1.8.1 branch too.  Seeking 1.8.0.x approval; if not 1.8.0.2 then 1.8.0.3.  This is a very safe patch that prevents your usual deleted-object-deref type crashes.

Comment 9

[Tim Riley [:timr]]

Comment on attachment 214399 [details] [diff] [review]
patch

Too late for 1.8.0.2.  We have final bits.  "?"ing for  1.8.0.3.

Comment 10

[Bernd]

fix checked in on trunk and 1.8 branch

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using SeaMonkey trunk build 2006-03-13-09 on Windows XP trunk with https://bugzilla.mozilla.org/attachment.cgi?id=214380&action=view as the testcase.

Comment 12

[Jay Patel [:jay]]

Comment on attachment 214399 [details] [diff] [review]
patch

Please check in promptly on the 1.8.0 branch.  Thanks!

Comment 13

[Bernd]

fixed on the 1.8.0 branch

Comment 14

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4, no crash with testcase.