Closed Bug 365185 Opened 18 years ago Closed 18 years ago

Crash [@ nsTArray_base::ShiftData] when removing display:table style in table cell with rowspan=5

Categories

(Core :: Layout: Tables, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: martijn.martijn, Assigned: bernd_mozilla)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

See upcoming testcase that crashes Mozilla on load. Talkback ID: TB27798789X MSVCR80.dll + 0x150aa (0x781450aa) nsTArray_base::ShiftData [mozilla\xpcom\build\nstarray.cpp, line 176] nsTArray_base::InsertSlotsAt [mozilla\xpcom\build\nstarray.cpp, line 196] nsTArray<CellData *>::InsertElementsAt<CellData *> [mozilla\dist\include\xpcom\nstarray.h, line 653] nsCellMap::InsertCells [mozilla\layout\tables\nscellmap.cpp, line 1683] nsTableCellMap::InsertCells [mozilla\layout\tables\nscellmap.cpp, line 669] nsTableFrame::InsertCells [mozilla\layout\tables\nstableframe.cpp, line 960] nsTableRowFrame::InsertFrames [mozilla\layout\tables\nstablerowframe.cpp, line 238] nsFrameManager::InsertFrames [mozilla\layout\base\nsframemanager.cpp, line 696] I haven't looked for a regression range, but I guess this a regression from bug 356335.
Attached file testcase
taking for now, there a couple of patches on the dependency list that wait for review
Assignee: nobody → bernd_mozilla
Testcase is worksforme, with a 2006-01-03 trunk build, I guess one of the patches from the similar bugs fixed (I'm too lazy to look which bug might have fixed this, if it is desired, though, I can look for it).
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME
fixed by bug 364318 on the 20070101
Depends on: 364318
Resolution: WORKSFORME → FIXED
Crash Signature: [@ nsTArray_base::ShiftData]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: