330499 - Crash with object, fieldset and legends, using display:none/table and position:absolute

Status: RESOLVED DUPLICATE of bug 329768

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes on load.
This regressed between 2005-09-21 and 2005-09-22, so I guess bug 1156 made it crash-prone.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Talkback ID: TB16371920W
nsHTMLReflowState::ComputePadding   nsHTMLReflowState::InitConstraints   nsHTMLReflowState::Init   nsHTMLReflowState::nsHTMLReflowState   nsAbsoluteContainingBlock::ReflowAbsoluteFrame

Comment 2

[Martijn Wargers (dead)]

Attachment: Backtrace from debug build

Prior to the crash, I get (a lot of) assertions, I added the backtrace for the first two:
###!!! ASSERTION: unknown out of flow frame type: 'NS_STYLE_FLOAT_NONE != disp->
mFloats', file c:/mozilla/mozilla/layout/generic/nsHTMLReflowState.cpp, line 484

###!!! ASSERTION: Expected to solve for left: 'NS_AUTOOFFSET == kidReflowState.m
ComputedOffsets.left', file c:/mozilla/mozilla/layout/generic/nsAbsoluteContaini
ngBlock.cpp, line 563

The actual crash is in:
Program received signal SIGSEGV, Segmentation fault.
0x05cb479e in nsIFrame::GetNextSibling() const (this=0xdddddddd)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:664
664       nsIFrame* GetNextSibling() const { return mNextSibling; }
Current language:  auto; currently c++
(gdb) bt
#0  0x05cb479e in nsIFrame::GetNextSibling() const (this=0xdddddddd)
    at c:/mozilla/mozilla/layout/generic/nsIFrame.h:664
#1  0x0569d57a in nsLayoutUtils::GetLastSibling(nsIFrame*) (aFrame=0xdddddddd)
    at c:/mozilla/mozilla/layout/base/nsLayoutUtils.cpp:365
#2  0x0564fff4 in nsFrameConstructorState::ProcessFrameInsertions(nsAbsoluteItem
s&, nsIAtom*) (this=0x22f6b0, aFrameItems=@0x22f6c8, aChildListName=0xe34528)
    at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:1511
#3  0x0564f16e in nsFrameConstructorState::~nsFrameConstructorState() (
    this=0x22f6b0)
    at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:1265
#4  0x056653b3 in nsCSSFrameConstructor::ContentInserted(nsIContent*, nsIContent
*, int, nsILayoutHistoryState*, int) (this=0xe8a5888, aContainer=0xe8d8638,
    aChild=0xe8d8858, aIndexInContainer=1, aFrameState=0xe8de088,
    aInReinsertContent=0)
    at c:/mozilla/mozilla/layout/base/nsCSSFrameConstructor.cpp:9742
etc.

Comment 3

[Martijn Wargers (dead)]

Ok, testcase doesn't crash anymore, so fixed by bug 329768.

*** This bug has been marked as a duplicate of 329768 ***