Closed Bug 354489 Opened 13 years ago Closed 13 years ago

[FIX]Crash [@ nsBlockBandData::Init] with mathml:mtable in xul

Categories

(Core :: Layout, defect, P2, critical)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.9alpha1

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

Details

(4 keywords)

Crash Data

Attachments

(3 files)

testcase
310 bytes, application/vnd.mozilla.xul+xml
Details
Fix
1.37 KB, patch
rbs
: review+
rbs
: superreview+
mconnor
: approval1.8.0.9+
mconnor
: approval1.8.1.1+
Details | Diff | Splinter Review
branch version
1.45 KB, patch
Details | Diff | Splinter Review 
After removing the following rule in mathml.css:

/* MathML doesn't permit positioning */
*, * > *|* {
  position: static !important;
}

and then loading the testcase that I'll attach, Mozilla crashes.
Talkback ID: TB23813261X
nsBlockBandData::Init  [mozilla\layout\generic\nsblockbanddata.cpp, line 72]
nsBlockFrame::Reflow  [mozilla\layout\generic\nsblockframe.cpp, line 803]
Attached file testcase — 
No need for positioning or removing the rule.  Just having an mtable in XUL crashes; no surprise.  :(
Summary: Crash [@ nsBlockBandData::Init] with position mathml:mtable in xul when mathml.css rule removed → Crash [@ nsBlockBandData::Init] with mathml:mtable in xul
Attached patch Fix — — Splinter Review
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Attachment #240392 - Flags: superreview?(rbs)
Attachment #240392 - Flags: review?(rbs)
OS: Windows XP → All
Priority: -- → P2
Hardware: PC → All
Summary: Crash [@ nsBlockBandData::Init] with mathml:mtable in xul → [FIX]Crash [@ nsBlockBandData::Init] with mathml:mtable in xul
Comment on attachment 240392 [details] [diff] [review]
Fix

r+sr=rbs
Attachment #240392 - Flags: superreview?(rbs)
Attachment #240392 - Flags: superreview+
Attachment #240392 - Flags: review?(rbs)
Attachment #240392 - Flags: review+
Fixed.
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Flags: blocking1.8.1.1?
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9alpha
Attachment #240392 - Flags: approval1.8.0.9?
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060928 Minefield/3.0a1
Status: RESOLVED → VERIFIED
Flags: blocking1.8.0.9?
Flags: blocking1.8.1.1?
Flags: blocking1.8.1.1+
Flags: blocking1.8.0.9?
Flags: blocking1.8.0.9+
Attachment #240392 - Flags: approval1.8.1.1?
Comment on attachment 240392 [details] [diff] [review]
Fix

a=mconnor on behalf of drivers for 1.8.0.9 and 1.8.1.1 checkin
Attachment #240392 - Flags: approval1.8.1.1?
Attachment #240392 - Flags: approval1.8.1.1+
Attachment #240392 - Flags: approval1.8.0.9?
Attachment #240392 - Flags: approval1.8.0.9+
Fixed for 1.8.0.9, 1.8.1
Keywords: fixed1.8.0.9, fixed1.8.1
I meant 1.8.1.1.
Keywords: fixed1.8.1 → fixed1.8.1.1
Verified fixed on 1.8.1 and 1.8.0.x branches by testing builds before and after the patch went in.
Keywords: fixed1.8.0.9, fixed1.8.1.1 → verified1.8.0.9, verified1.8.1.1
Crash Signature: [@ nsBlockBandData::Init]
You need to log in before you can comment on or make changes to this bug.