Last Comment Bug 348126 - Crash [@ nsImageFrame::SourceRectToDest] on reload and removing table-caption styles
: Crash [@ nsImageFrame::SourceRectToDest] on reload and removing table-caption...
Status: VERIFIED FIXED
[sg:critical] regression from bug 309322
: crash, regression, testcase, verified1.8.1.8
Product: Core
Classification: Components
Component: Layout: Tables (show other bugs)
: Trunk
: All All
: -- critical (vote)
: ---
Assigned To: Mats Palmgren (:mats)
:
:
Mentors:
Depends on: 337476
Blocks: 309322 framedest
  Show dependency treegraph
 
Reported: 2006-08-09 15:10 PDT by Martijn Wargers [:mwargers] (not working for Mozilla)
Modified: 2011-06-13 10:01 PDT (History)
8 users (show)
dveditz: blocking1.8.1.8+
dveditz: wanted1.8.1.x+
caillon: blocking1.8.0.next+
dveditz: wanted1.8.0.x+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (crashes on reload) (807 bytes, text/html)
2006-08-09 15:11 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
animated gif (807 bytes, text/html)
2006-08-09 15:13 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
testcase (crashes on reload) (897 bytes, text/html)
2006-08-09 15:15 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details
Finally the good testcase (crashes on reload) (897 bytes, text/html)
2006-08-09 15:20 PDT, Martijn Wargers [:mwargers] (not working for Mozilla)
no flags Details

Description Martijn Wargers [:mwargers] (not working for Mozilla) 2006-08-09 15:10:24 PDT
See upcoming testcase, which crashes on reload in current trunk build.
This regressed between 2005-12-03 and 2005-12-04, probably a regression from bug 309322.

I guess there is a security issue here.
Comment 1 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-08-09 15:11:53 PDT
Created attachment 232985 [details]
testcase (crashes on reload)
Comment 2 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-08-09 15:13:13 PDT
Created attachment 232986 [details]
animated gif

Argh! I forgot about the fish.
Comment 3 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-08-09 15:15:17 PDT
Created attachment 232987 [details]
testcase (crashes on reload)
Comment 4 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-08-09 15:20:25 PDT
Created attachment 232988 [details]
Finally the good testcase (crashes on reload)
Comment 5 Jesse Ruderman 2006-08-09 21:12:35 PDT
I can reproduce on Mac trunk (debug build).

On load:

###!!! ASSERTION: unexpected child list: 'PR_FALSE', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 243
###!!! ASSERTION: invalid previous frame: '!aPrevFrame', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 266
###!!! ASSERTION: unexpected child list: 'PR_FALSE', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 243
###!!! ASSERTION: illegal next frame in incremental reflow.: 'PR_FALSE', file /Users/admin/trunk/mozilla/layout/tables/nsTableOuterFrame.cpp, line 1393

On reload, with the patch for bug 334514:

###!!! ASSERTION: Some frame destructors were not called.: 'mFrameCount == 0', file /Users/admin/trunk/mozilla/layout/base/nsPresShell.cpp, line 629

(One nice thing about using the patch for bug 334514 is that you can reload and see whether the assertion fires, rather than reloading an seeing whether Firefox crashes, if you take out the animated GIFs.)

Crash trying to read memory at 0xdadadaf6.

Dup of bug 337476?
Comment 6 Martijn Wargers [:mwargers] (not working for Mozilla) 2006-08-10 02:00:07 PDT
Yeah, could very well be the same bug.
Comment 7 Bernd 2006-10-29 00:11:40 PDT
fixed by the checkin for bug bug 341858 
Comment 8 Daniel Veditz [:dveditz] 2007-04-25 13:56:39 PDT
Moving to 1.8.1.5 following bug 309322
Comment 9 Daniel Veditz [:dveditz] 2007-07-09 15:16:45 PDT
Moving to 1.8.1.6 following bug 309322
Comment 10 Daniel Veditz [:dveditz] 2007-10-04 14:45:00 PDT
fix checked into branch with bug 309322
Comment 11 Tony Chung [:tchung] 2007-10-05 03:24:42 PDT
Verified fix on Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.8) Gecko/20071004 Firefox/2.0.0.8: Firefox 2.0.0.8 ID:2007100415.   Testcase doesnt crash on reload. 
Comment 12 Bob Clary [:bc:] 2009-04-24 11:02:20 PDT
crash test landed
http://hg.mozilla.org/mozilla-central/rev/3d0c408c687c

Note You need to log in before you can comment on or make changes to this bug.