363448 - Crash [@ nsCachedStyleData::GetStyleData] with testcase, using floating and absolutely positioned iframes

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes Mozilla on load.
This regressed between 2006-10-18 and 2006-10-19, probably a regression from bug 343445.

Talkback ID: TB27156522Y
nsCachedStyleData::GetStyleData  [mozilla\layout\style\nsrulenode.h, line 215]
nsLayoutUtils::GetFloatFromPlaceholder  [mozilla\layout\base\nslayoututils.cpp, line 196]
(the talkback ID is from an older talkback ID, because talkback is lagging currently, talkback ID from minimised testcase: TB27176698H)
For some reason my debug build isn't crashing.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Ronald Tilby]

Testcase WFM using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070106 Minefield/3.0a2pre ID:2007010604 [cairo]

Comment 3

[Martijn Wargers (dead)]

Yeah, crashes with a 2006-12-20 build, not anymore with a 2006-12-22 build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-12-20+04&maxdate=2006-12-22+10&cvsroot=%2Fcvsroot
Fixed by one of the patches in bug 363813.

Comment 4

[Mats Palmgren (inactive)]

Crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/070fcf10db45

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/070fcf10db45