365185 - Crash [@ nsTArray_base::ShiftData] when removing display:table style in table cell with rowspan=5

Status: RESOLVED FIXED

Description

[Martijn Wargers (zombie)]

See upcoming testcase that crashes Mozilla on load.

Talkback ID: TB27798789X
MSVCR80.dll + 0x150aa (0x781450aa)
nsTArray_base::ShiftData  [mozilla\xpcom\build\nstarray.cpp, line 176]
nsTArray_base::InsertSlotsAt  [mozilla\xpcom\build\nstarray.cpp, line 196]
nsTArray<CellData *>::InsertElementsAt<CellData *>  [mozilla\dist\include\xpcom\nstarray.h, line 653]
nsCellMap::InsertCells  [mozilla\layout\tables\nscellmap.cpp, line 1683]
nsTableCellMap::InsertCells  [mozilla\layout\tables\nscellmap.cpp, line 669]
nsTableFrame::InsertCells  [mozilla\layout\tables\nstableframe.cpp, line 960]
nsTableRowFrame::InsertFrames  [mozilla\layout\tables\nstablerowframe.cpp, line 238]
nsFrameManager::InsertFrames  [mozilla\layout\base\nsframemanager.cpp, line 696]

I haven't looked for a regression range, but I guess this a regression from bug 356335.

Comment 1

[Martijn Wargers (zombie)]

Created attachment 249810 [details]
testcase

Comment 2

[Peter van der Woude [:Peter6]]

regressionwindow:
works in 20061206_1427_1456_firefox-3.0a1.en-US.win32
fails in 20061206_2127_2152_firefox-3.0a1.en-US.win32

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-12-06+14%3A27&maxdate=2006-12-06+21%3A52&cvsroot=%2Fcvsroot

bug 356335 fits

Comment 3

[Bernd]

taking for now, there a couple of patches on the dependency list that wait for review

Comment 4

[Martijn Wargers (zombie)]

Testcase is worksforme, with a 2006-01-03 trunk build, I guess one of the patches from the similar bugs fixed (I'm too lazy to look which bug might have fixed this, if it is desired, though, I can look for it).

Comment 5

[Peter van der Woude [:Peter6]]

fixed by bug 364318 on the 20070101