Closed Bug 341814 Opened 19 years ago Closed 18 years ago

Trunk [@ nsCSSRendering::PaintBackgroundWithSC] - crash when setting table-rows to display:none

Categories

(Core :: Layout: Tables, defect)

Product:
Core
Component:
Layout: Tables
Version:
1.8 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: dherman, Assigned: bernd_mozilla)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

test case that crashes Firefox
1.45 KB, text/html
Details 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

I will attach a test case. There's a table with a couple tbody elements, and dynamically hiding one of them crashes Firefox. It seems to have something to do with the left element having a rowspan > 1, because when I remove that it doesn't crash.

Reproducible: Always

Steps to Reproduce:
1. Load the file I'm attaching in Firefox.
2. Click on the second tbody in the table.

Actual Results:  
crash

Expected Results:  
hide the second tbody

    
    

    
  
Crash is reproducible on Seamonkey 1.5a rv:1.9a1 build 2006061609 under XP Pro SP2.

Talkback incident id: TB19953673G

Adding keywords: testcase, crash, talkbackid

------

Dave H., you can set the tbody visibility to collapse instead (as a workaround):

Dynamic table formating:
http://www.gtalbot.org/DHTMLSection/DynamicTableFormatting.html

Your code could be done differently also ...



Keywords: crash, 
          
            talkbackid, 
          
            testcase

    
    

    
  
For Firefox 1.5.0.4:

TB19953996W

    
    

    
  
The testcase is not setting the tbody to display: none but rather to the table-rows within that tbody via toggling classname. It is not the same thing.

CONFIRMING and updating summary accordingly

Component set to: DOM: CSSOM
Status: UNCONFIRMED → NEW
Component: Layout: Tables → DOM: CSSOM
Ever confirmed: true
Summary: crash on dynamically setting tbody to display:none → Trunk [@ nsCSSRendering::PaintBackgroundWithSC] - crash when setting table-rows to display:none

    
    

    
  
Incident ID: 19953996
Stack Signature	nsCSSRendering::PaintBackgroundWithSC 3b6aee3b
Product ID	Firefox15
Build ID	2006050817
Trigger Time	2006-06-16 15:50:07.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (002984e1)
URL visited	
User Comments	Bug 341814 setting tbody to display none
Since Last Crash	122279 sec
Total Uptime	122279 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsCSSRendering.cpp, line 2819
Stack Trace 	
nsCSSRendering::PaintBackgroundWithSC  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsCSSRendering.cpp, line 2819]
TableBackgroundPainter::PaintCell  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTablePainter.cpp, line 608]
TableBackgroundPainter::PaintRow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTablePainter.cpp, line 565]
TableBackgroundPainter::PaintRowGroup  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTablePainter.cpp, line 503]
TableBackgroundPainter::PaintTable  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTablePainter.cpp, line 453]
nsTableFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1402]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsTableOuterFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/nsTableOuterFrame.cpp, line 336]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6445]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6272]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsBlockFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/tables/../generic\nsBlockFrame.h, line 287]
nsBlockFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6445]
nsHTMLContainerFrame::PaintDecorationsAndChildren  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 138]
nsBlockFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsBlockFrame.cpp, line 6272]
nsContainerFrame::PaintChild  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 283]
nsContainerFrame::PaintChildren  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 228]
nsHTMLContainerFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLContainerFrame.cpp, line 84]
CanvasFrame::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLFrame.cpp, line 385]
PresShell::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5818]
nsView::Paint  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 316]
nsViewManager::RenderDisplayListElement  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1460]
nsViewManager::RenderViews  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 1375]
nsViewManager::Refresh  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 930]
nsViewManager::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsViewManager.cpp, line 2047]
HandleEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/view/src/nsView.cpp, line 174]
nsWindow::DispatchEvent  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1258]
nsWindow::ProcessMessage  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4399]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1440]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0xb4c0 (0x77d4b4c0)
USER32.dll + 0xb50c (0x77d4b50c)
ntdll.dll + 0xeae3 (0x7c90eae3)
nsWindow::DispatchStarvedPaints  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4188]
USER32.dll + 0xda57 (0x77d4da57)
nsWindow::DispatchPendingEvents  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4226]
nsWindow::ProcessMessage  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 4664]
nsWindow::WindowProc  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsWindow.cpp, line 1440]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/widget/src/windows/nsAppShell.cpp, line 159]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
main  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)
Assignee: nobody → general
Keywords: talkbackid
QA Contact: layout.tables → ian
Assignee: general → nobody
Component: DOM: CSSOM → Layout: Tables
QA Contact: ian → layout.tables

    
    

    
  
the patch in bug 339246 fixes this crash
Assignee: nobody → bernd_mozilla
Depends on: 339246

    
    

    
  
As Bernd said in comment 6, this is fixed on trunk by bug 339246, the crash can still be seen on branch builds.
Version: Trunk → 1.8 Branch

    
    

    
  
marking fixed
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED

    
    

    
  
This will very likely be fixed on branch as part of bug 346980.

    
    

    
  
testcase in this bug was used to verify bug 339246.
Crash Signature: [@ nsCSSRendering::PaintBackgroundWithSC]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: