Closed Bug 344061 Opened 18 years ago Closed 18 years ago

Crash [@ nsHTMLReflowState::CalculateHypotheticalBox] on 1.8.0.5 branch

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
1.8 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, fixed1.8.0.7, testcase)

Crash Data

Attachments

(1 file)

testcase
1.10 KB, application/vnd.mozilla.xul+xml
Details 
See upcoming testcase, it only crashes 1.8.0.5 branch, not the other branches, it seems. I can reduce it further, if desired.
Attached file testcase — 

    
    

    
  
Talkback ID: TB20766152G
nsHTMLReflowState::CalculateHypotheticalBox  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLReflowState.cpp, line 893]
nsHTMLReflowState::InitAbsoluteConstraints  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1067]
nsHTMLReflowState::InitConstraints  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLReflowState.cpp, line 1965]
nsHTMLReflowState::Init  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLReflowState.cpp, line 342]
nsHTMLReflowState::nsHTMLReflowState  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsHTMLReflowState.cpp, line 315]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp, line 521]
nsAbsoluteContainingBlock::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp, line 208]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 300]
PresShell::InitialReflow  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 2871]
nsXULDocument::StartLayout  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2198]
nsXULDocument::ResumeWalk  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3233]
nsXULDocument::EndLoad  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 740]
XULContentSinkImpl::DidBuildModel  [c:/builds/tinderbox/Fx-Mozilla1.8.0-Release/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULContentSink.cpp, line 408]

    
  
Version: Trunk → 1.8 Branch

    
    

    
  
This was probably fixed by bug 253479.

    
    

    
  
Fixed on trunk and 1.8.1 branch, I mean.
Depends on: 253479

    
    

    
  
Ok, fixed by bug 253479, no crash with a 1.5 2006-08-21 build, but I did crash with a 2006-08-14 build.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Group: security
Keywords: fixed1.8.0.7
Crash Signature: [@ nsHTMLReflowState::CalculateHypotheticalBox]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: