354510 - [FIX]Crash [@ nsBlockBandData::Init] when moving mathml:geq inside html:span with display:table with removed mathml.css rule

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Martijn Wargers (dead)]

After removing the following rule in mathml.css:

/* MathML doesn't permit positioning */
*, * > *|* {
  position: static !important;
}

and then loading the testcase that I'll attach, Mozilla crashes.

Talkback ID: TB23819757Y
nsBlockBandData::Init  [mozilla\layout\generic\nsblockbanddata.cpp, line 72]
nsBlockFrame::Reflow  [mozilla\layout\generic\nsblockframe.cpp, line 803]

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix more wonderful inconsistencies between tables and MathML tables

Comment 3

[Boris Zbarsky [:bzbarsky]]

I should note that the position rule should not matter here -- no positioning is used in the testcase.

Comment 4

[rbs]

Comment on attachment 240390 [details] [diff] [review]
Fix more wonderful inconsistencies between tables and MathML tables

r+sr=rbs

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 6

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060928 Minefield/3.0a1

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: Branch version

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed for 1.8.1, 1.8.0.9

Comment 9

[Boris Zbarsky [:bzbarsky]]

I meant 1.8.1.1.

Comment 10

[Martijn Wargers (dead)]

Verified fixed on branches by lxr code inspection.