Closed Bug 336291 Opened 19 years ago Closed 19 years ago

Crash [@ nsTableFrame::GetRowGroupFrame]

Categories

(Core :: Layout: Tables, defect)

defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: jruderman, Assigned: bernd_mozilla)

References

Details

(5 keywords)

Crash Data

Attachments

(4 files)

Attached file testcase
Thread 0 Crashed: nsTableFrame::GetRowGroupFrame nsCSSFrameConstructor::CreateHTMLImageFrame <-- what image? nsCSSFrameConstructor::CreateHTMLImageFrame nsCSSFrameConstructor::CreateHTMLImageFrame nsCSSFrameConstructor::TableProcessChildren ...
Bob Clary found this during automatic testing; I reduced it.
Attached file stack winxp
2006-04-22 trunk nightly crashes 2006-04-21 trunk nightly doesn't crash I suspect the checkin in bug 333493 or bug 331679.
OS: Mac OS X 10.4 → All
Hardware: Macintosh → All
Attached patch patchSplinter Review
seems to be legitimate to ask why do we ever enter ProcessPseudoFrames with a zero parent. I would like to add an assert to check for this error condition. However this can not be done before I fix core issue here. And after my disaster with the overflow assert on the branches, I will not check in any assert into branch. Its difficult to overestimate the benefit that we get from daily fuzz testing.
Assignee: nobody → bernd_mozilla
Status: NEW → ASSIGNED
Attachment #220611 - Flags: superreview?(bzbarsky)
Attachment #220611 - Flags: review?(bzbarsky)
>f..... bugzilla throws error messages at eats comments here the first part of the comment: This patch fixes the error in the patch for bug 331679. What we usually do is we check for childitems of a pseudo frame and only if they are present we process the pseudo. This is what we do here also now. I intentionaly keep this patch small as I would like to get bug 331679 onto branches. The core issue is however here: else if (nsLayoutAtoms::tableRowGroupFrame == pseudoFrames.mLowestType) { rv = ProcessPseudoRowGroupFrame(pseudoFrames.mRowGroup, aHighestFrame); I assumed that pseudoFrames.mRowGroup is not zero. This will require some digging and who knows how large the required change will be. It... (see comment before)
Blocks: 331679
Comment on attachment 220611 [details] [diff] [review] patch r+sr=bzbarsky Just add the asserts on trunk; no more review needed for those.
Attachment #220611 - Flags: superreview?(bzbarsky)
Attachment #220611 - Flags: superreview+
Attachment #220611 - Flags: review?(bzbarsky)
Attachment #220611 - Flags: review+
Looks like this patch was checked into trunk 2006-05-04 11:26. Should this bug be marked as fixed?
I am no longer see this signature.
fix checked in, followup bug 336951. The asserts will be added there.
Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Verified FIXED; I'm unable to reproduce the crash anymore using build 2006-05-07-06 of SeaMonkey trunk under Windows XP on https://bugzilla.mozilla.org/attachment.cgi?id=220537&action=view
Status: RESOLVED → VERIFIED
Would this patch be suitable and safe enough for branch(es)?
Flags: blocking1.8.1?
Flags: blocking1.8.0.6?
Comment on attachment 220611 [details] [diff] [review] patch Man do I suck, I just forgot this one. Thanks Martijn.
Attachment #220611 - Flags: approval1.8.1?
Attachment #220611 - Flags: approval1.8.0.6?
Flags: blocking1.8.1? → blocking1.8.1+
Comment on attachment 220611 [details] [diff] [review] patch a=dbaron on behalf of drivers. Please check in to MOZILLA_1_8_BRANCH and mark fixed1.8.1 once you have.
Attachment #220611 - Flags: approval1.8.1? → approval1.8.1+
Whiteboard: [checkin needed (1.8 branch)]
Flags: blocking1.8.0.6? → blocking1.8.0.6+
fix checked in into 1.8.1
Keywords: fixed1.8.1
Whiteboard: [checkin needed (1.8 branch)]
Comment on attachment 220611 [details] [diff] [review] patch approved for 1.8.0 branch, a=dveditz for drivers
Attachment #220611 - Flags: approval1.8.0.7? → approval1.8.0.7+
I've checked it in the 1.8.0 branch, since Bernd is on vacation (I hope/expect that Bernd is ok with that).
Keywords: fixed1.8.0.7
Verified FIXED using Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1b1) Gecko/20060731 BonEcho/2.0b1 and the testcase from comment 1.
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7pre) Gecko/20060821 Firefox/1.5.0.7pre https://bugzilla.mozilla.org/attachment.cgi?id=220537&action=view, no crash. verified 1.8.0.7
Crashtest checked in.
Flags: in-testsuite+
Crash Signature: [@ nsTableFrame::GetRowGroupFrame]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: