Closed Bug 354510 Opened 13 years ago Closed 13 years ago

[FIX]Crash [@ nsBlockBandData::Init] when moving mathml:geq inside html:span with display:table with removed mathml.css rule

Categories

(Core :: Layout, defect, P2, critical)

defect

Tracking

()

VERIFIED FIXED
mozilla1.9alpha1

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

References

(Blocks 1 open bug)

Details

(4 keywords)

Crash Data

Attachments

(3 files)

After removing the following rule in mathml.css:

/* MathML doesn't permit positioning */
*, * > *|* {
  position: static !important;
}

and then loading the testcase that I'll attach, Mozilla crashes.

Talkback ID: TB23819757Y
nsBlockBandData::Init  [mozilla\layout\generic\nsblockbanddata.cpp, line 72]
nsBlockFrame::Reflow  [mozilla\layout\generic\nsblockframe.cpp, line 803]
Attached file testcase
Blocks: stirdom
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Attachment #240390 - Flags: superreview?(rbs)
Attachment #240390 - Flags: review?(rbs)
Flags: blocking1.8.1.1?
Flags: blocking1.8.0.9?
OS: Windows XP → All
Priority: -- → P2
Hardware: PC → All
Summary: Crash [@ nsBlockBandData::Init] when moving mathml:geq inside html:span with display:table with removed mathml.css rule → [FIX]Crash [@ nsBlockBandData::Init] when moving mathml:geq inside html:span with display:table with removed mathml.css rule
Target Milestone: --- → mozilla1.9alpha
I should note that the position rule should not matter here -- no positioning is used in the testcase.
Comment on attachment 240390 [details] [diff] [review]
Fix more wonderful inconsistencies between tables and MathML tables

r+sr=rbs
Attachment #240390 - Flags: superreview?(rbs)
Attachment #240390 - Flags: superreview+
Attachment #240390 - Flags: review?(rbs)
Attachment #240390 - Flags: review+
Fixed.
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attachment #240390 - Flags: approval1.8.0.9?
Flags: blocking1.8.0.9?
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060928 Minefield/3.0a1
Status: RESOLVED → VERIFIED
Flags: blocking1.8.0.9?
Flags: blocking1.8.1.1?
Flags: blocking1.8.1.1+
Flags: blocking1.8.0.9?
Flags: blocking1.8.0.9+
Attachment #240390 - Flags: approval1.8.1.1?
Attachment #240390 - Flags: approval1.8.1.1?
Attachment #240390 - Flags: approval1.8.1.1+
Attachment #240390 - Flags: approval1.8.0.9?
Attachment #240390 - Flags: approval1.8.0.9+
Fixed for 1.8.1, 1.8.0.9
I meant 1.8.1.1.
Keywords: fixed1.8.1fixed1.8.1.1
Verified fixed on branches by lxr code inspection.
Crash Signature: [@ nsBlockBandData::Init]
You need to log in before you can comment on or make changes to this bug.