Closed Bug 353894 Opened 18 years ago Closed 18 years ago

[FIX]Crash [@ nsBlockBandData::Init] with position:fixed on mathml when position:static !important rule is removed in mathml.css

Categories

(Core :: MathML, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla1.9alpha1

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

References

Details

(4 keywords)

Crash Data

Attachments

(3 files)

See upcoming testcase, which crashes in current trunk builds, when you have removed this:
/* MathML doesn't permit positioning */
*, * > *|* {
  position: static !important;
}
in mathml.css

Talkback ID: TB23627691G
nsBlockBandData::Init  [mozilla\layout\generic\nsblockbanddata.cpp, line 72]
nsBlockFrame::Reflow  [mozilla\layout\generic\nsblockframe.cpp, line 803]
Attached file testcase
Summary: Crash [@ nsBlockBandData::Init] wit position:fixed on mathml when position:static !important rule is removed in mathml.css → Crash [@ nsBlockBandData::Init] with position:fixed on mathml when position:static !important rule is removed in mathml.css
Keep and eye on bug 322625, which aims at removing the rule and solving the problem with rock solid C++.
(In reply to comment #2)
> Keep and eye on bug 322625, which aims at removing the rule and solving the
> problem with rock solid C++.

Yeah, Boris and Jesse basically told me to file this bug and bug 353897, because those rules will get removed.
Attachment #239919 - Flags: superreview?(rbs)
Attachment #239919 - Flags: review?(rbs)
I'd like to get this in on branches too, by the way.
Assignee: rbs → bzbarsky
OS: Windows XP → All
Priority: -- → P1
Hardware: PC → All
Target Milestone: --- → mozilla1.9alpha
Summary: Crash [@ nsBlockBandData::Init] with position:fixed on mathml when position:static !important rule is removed in mathml.css → [FIX]Crash [@ nsBlockBandData::Init] with position:fixed on mathml when position:static !important rule is removed in mathml.css
What if somebody does this?
<style>
mi { display: block; }
</style>

<body>
<mi>x</mi>  <!-- i.e., no <math>...</math> --->
</body>
Might be safer to do that in the frame constructor? So a to add the bit to any frame that claims to be isBlock()?
> What if somebody does this?

What if they do?  We'll create an nsMathMLTokenFrame for it, which is not actually a block frame.  What's the problem?

> So a to add the bit to any frame that claims to be isBlock()?

That would break float handling.  Having that bit set means that you're doing your own float layout independent of your parent (which most blocks shouln't be doing, but <math> certainly should).
Comment on attachment 239919 [details] [diff] [review]
Not sure why this wasn't done to start with

r+sr=rbs

> We'll create an nsMathMLTokenFrame for it

I remembered that after posting my comment.
Attachment #239919 - Flags: superreview?(rbs)
Attachment #239919 - Flags: superreview+
Attachment #239919 - Flags: review?(rbs)
Attachment #239919 - Flags: review+
Fixed.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Blocks: 322625
Comment on attachment 239919 [details] [diff] [review]
Not sure why this wasn't done to start with

Probably worth fixing on the branches.
Attachment #239919 - Flags: approval1.8.1?
Attachment #239919 - Flags: approval1.8.0.8?
Comment on attachment 239919 [details] [diff] [review]
Not sure why this wasn't done to start with

Approved for RC2.
Attachment #239919 - Flags: approval1.8.1? → approval1.8.1+
Attached patch Merged to branchSplinter Review
Fixed on 1.8 branch.
Keywords: fixed1.8.1
Flags: blocking1.8.0.8+
Comment on attachment 239919 [details] [diff] [review]
Not sure why this wasn't done to start with

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #239919 - Flags: approval1.8.0.8? → approval1.8.0.8+
Fixed for 1.8.0.8.
Keywords: fixed1.8.0.8
verified on the 1.8.0 branch using Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.8) Gecko/20061023 Firefox/1.5.0.8. No crash with the testcase listed in Comment 1. Adding keyword.
Depends on: 362701
Crash Signature: [@ nsBlockBandData::Init]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: