341227 - Crash called from [@ nsIFrame::GetStyleData] called from nsCSSRendering::PaintBackgroundWithSC

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Jesse Ruderman]

This testcase crashes a debug build that has the patches for bug 339130, bug 339246, and bug 339315.

The stack traces are somewhat similar to those in bug 339246 and bug 339315.

Before the crash, I see:

2 * ###!!! ASSERTION: invalid number of columns: 'colX < GetColCount()', file /Users/admin/trunk/mozilla/layout/tables/nsTableFrame.cpp, line 1677

1 * ###!!! ASSERTION: prevent array boundary violation: 'colIndex < mNumCols', file /Users/admin/trunk/mozilla/layout/tables/nsTablePainter.cpp, line 416

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Jesse Ruderman]

Attachment: gdb output (mac debug)

Comment 3

[Jesse Ruderman]

> The stack traces are somewhat similar to those in bug 339246 and bug 339315.

And bug 339165.

Comment 4

[Bernd]

the revised patch in bug 339246 fixes the crash but not the assertion, the assertion is a critical one as it indicates a severe mismatch between the frame structure and the cellmap.  This usually crashes with the first style reference either to noninitialzed memory or for a allready deleted cell position.

Comment 5

[Bernd]

attchment 225587 from bug 339246 fixes this entirely, no assertion no crash.

Comment 6

[Jesse Ruderman]

I think bug 341814 has the same stack signature.

Comment 7

[Bernd]

marking fixed

Comment 8

[Martijn Wargers (dead)]

Yes, current trunk debug build doesn't crash (as normal trunk builds don't crash) on the testcase and I don't see any assertions.
So this is most likely fixed by bug 339246, as bernd said in comment 5.

Comment 9

[Christopher Aillon (sabbatical, not receiving bugmail)]

Just tested this on firefox 1.5.0.8 no crash with the testcase.

Comment 10

[Jesse Ruderman]

Crashtest checked in.