Debug only crash [@ IncrementalReflow::AddCommand] with display: table-row-group and display: table-caption

RESOLVED FIXED

Status

()

Core
Layout: Tables
--
critical
RESOLVED FIXED
12 years ago
6 years ago

People

(Reporter: Martijn Wargers (dead), Assigned: mats)

Tracking

({crash, testcase})

Trunk
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: post 1.8-branch, crash signature)

Attachments

(2 attachments)

(Reporter)

Description

12 years ago
See upcoming testcase, which crashes in my debug build (and that one is up to date).
Regular trunk builds don't seem to crash.

Maybe related to bug 341858?
Also, I get the assertions which a bug has been filed about in bug 337476.
(Reporter)

Comment 1

12 years ago
Created attachment 227719 [details]
testcase

The testcase consists of this:
<object>
<form>
</object>

<table>
<body style="display: table-row-group;">
<optgroup>
<keygen style="display: table-caption;">
<param>
<dt style="display: table-caption;">
<tbody>
(Reporter)

Comment 2

12 years ago
Created attachment 227720 [details]
Backtrace

#0  0x061b79de in nsIFrame::GetStateBits (this=0x14)
    at c:/mozilla/mozilla/layout/svg/base/src/../../../generic/nsIFrame.h:896
#1  0x05b88e7a in IncrementalReflow::AddCommand (this=0x22f89c,
    aPresContext=0x104c9b40, aCommand=0x1076c380)
    at c:/mozilla/mozilla/layout/base/nsPresShell.cpp:882
#2  0x05b9904a in PresShell::ProcessReflowCommands (this=0x1084d2d0,
    aInterruptible=1) at c:/mozilla/mozilla/layout/base/nsPresShell.cpp:6588
#3  0x05b98ac0 in PresShell::ReflowEvent::Run (this=0x10860938)
    at c:/mozilla/mozilla/layout/base/nsPresShell.cpp:6462
#4  0x00536b2a in nsThread::ProcessNextEvent (this=0x3f72f8, mayWait=1,
    result=0x22fa60) at c:/mozilla/mozilla/xpcom/threads/nsThread.cpp:482
etc.

Comment 3

12 years ago
crashes my debug build too :-(
(Assignee)

Comment 4

12 years ago
I can crash a local seamonkey Opt build. I have a fix (in bug 341858)
Marking Security-Sensitive for the same reason as bug 341858
Assignee: nobody → mats.palmgren
Group: security
Depends on: 341858
OS: Windows XP → All
Hardware: PC → All

Comment 5

11 years ago
fixed by the checkin for bug 341858
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
I don't see this crash in my 1.8 branch debug build (Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.2pre) Gecko/20070126 BonEcho/2.0.0.2pre).
Whiteboard: post 1.8-branch
Group: security
Crash Signature: [@ IncrementalReflow::AddCommand]
You need to log in before you can comment on or make changes to this bug.