344057 - Crash [@ nsTableFrame::GetRowGroupFrame] on 1.8.1 branch

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes current 1.8.1 branch on load.
It doesn't crash 1.8.0.4 or current trunk build.
I can reduce the testcase further if asked.

I'm using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1b1) Gecko/20060709 BonEcho/2.0b1

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Talkback ID: TB20764795Z
nsTableFrame::GetRowGroupFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/tables/nsTableFrame.cpp, line 1226]
ProcessPseudoRowGroupFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 2500]
ProcessPseudoFrames  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 2716]
nsCSSFrameConstructor::TableProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4117]
nsCSSFrameConstructor::ConstructTableRowFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 3812]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6862]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7903]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7715]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12091]
nsCSSFrameConstructor::ConstructBlock  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13147]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6705]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7903]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7715]
nsCSSFrameConstructor::ProcessInlineChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13389]
nsCSSFrameConstructor::ConstructInline  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13201]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6775]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7903]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7715]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12091]
nsCSSFrameConstructor::ConstructBlock  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13147]
nsCSSFrameConstructor::ConstructFrameByDisplayType  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 6705]
nsCSSFrameConstructor::ConstructFrameInternal  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7903]
nsCSSFrameConstructor::ConstructFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 7715]
nsCSSFrameConstructor::ProcessChildren  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 12091]
nsCSSFrameConstructor::ConstructDocElementFrame  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 4615]
nsCSSFrameConstructor::ContentInserted  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9235]
PresShell::InitialReflow  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 2834]
nsContentSink::StartLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/base/src/nsContentSink.cpp, line 924]
nsXMLContentSink::StartLayout  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xml/document/src/nsXMLContentSink.cpp, line 875]
nsXMLContentSink::DidBuildModel  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xml/document/src/nsXMLContentSink.cpp, line 343]
nsExpatDriver::DidBuildModel  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 1227]

Comment 3

[Martijn Wargers (dead)]

I just found also an example that crashes 1.8.0.5 branch builds with the same stacktrace.

Comment 4

[Martijn Wargers (dead)]

Probably fixed on trunk by bug 336291.

Comment 5

[Daniel Veditz [:dveditz]]

On 1.5.0.5 with this testcase I eventually crash on a null dereference, but the way the browser semi-hung (got unresponsive, wouldn't load anything although the menu items worked) makes me worry about memory corruption.

1.8.1 crashed right away at the same spot (null dereference). Less worried about that, so maybe my 1.5.0.5 is seeing one of the other table bugs Bernd has fixed recently that has gotten landed on the 1.8 branch. I don't see any that aren't also in 1.8.0.5 though.

Comment 6

[Bernd]

Martijn, I checked in the fix for bug 336291 on 2006-07-29 into 1.8.1 does that fix this bug?

Comment 7

[Martijn Wargers (dead)]

Yes.

Comment 8

[Martijn Wargers (dead)]

Bug 336291 is now also fixed on the 1.8.0 branch.

Comment 9

[Bob Clary [:bc] (inactive)]

https://bugzilla.mozilla.org/attachment.cgi?id=228631&action=view
ff2b2 debug/nightly windows/linux no crash
verified fixed 1.8

Comment 10

[alice nodelman [:alice] [:anode]]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7pre) Gecko/20060821 Firefox/1.5.0.7pre

https://bugzilla.mozilla.org/attachment.cgi?id=228631&action=view should not crash browser

verified 1.8.0.7

Comment 11

[Bob Clary [:bc] (inactive)]

crash test landed
http://hg.mozilla.org/mozilla-central/rev/f7d7dabed4ee

sorry, ci comment referenced wrong bug. :-(

Comment 12

[Jesse Ruderman]

Changed the encoding:
http://hg.mozilla.org/mozilla-central/rev/b46704fdacc2