365211 - null dereference in nsHTMLReflowState::ComputeContainingBlockRectangle

Status: RESOLVED DUPLICATE of bug 363696

(Core :: Layout, defect)

Description

[georgi - hopefully not receiving bugspam]

<textbox width="20" type="file" id="in1" spellcheck="true" defaultValue="aaa" />

causes null dereference in nsHTMLReflowState::ComputeContainingBlockRectangle 

#0  0xbfffe410 in __kernel_vsyscall ()
#1  0xb72853a6 in nanosleep () from /lib/i686/libc.so.6
#2  0xb728519c in sleep () from /lib/i686/libc.so.6
#3  0xb7ede7f9 in ah_crap_handler (signum=11) at nsSigHandlers.cpp:134
#4  0xb7ef6148 in nsProfileLock::FatalSignalHandler (signo=11)
    at nsProfileLock.cpp:210
#5  <signal handler called>
#6  0xb4b26868 in nsHTMLReflowState::ComputeContainingBlockRectangle (
    this=0xbfb6bb8c, aPresContext=0x9a007f8, aContainingBlockRS=0x0, 
    aContainingBlockWidth=@0xbfb6baf8, aContainingBlockHeight=@0xbfb6bafc)
    at /opt/joro/firefox/mozilla/layout/generic/nsHTMLReflowState.cpp:1343
#7  0xb4b27cea in nsHTMLReflowState::InitConstraints (this=0xbfb6bb8c, 
    aPresContext=0x9a007f8, aContainingBlockWidth=-1, 
    aContainingBlockHeight=-1, aBorder=0x0, aPadding=0x0)
    at /opt/joro/firefox/mozilla/layout/generic/nsHTMLReflowState.cpp:1471
#8  0xb4b28520 in nsHTMLReflowState::Init (this=0xbfb6bb8c, 
    aPresContext=0x9a007f8, aContainingBlockWidth=-1, 
    aContainingBlockHeight=-1, aBorder=0x0, aPadding=0x0)
    at /opt/joro/firefox/mozilla/layout/generic/nsHTMLReflowState.cpp:226
#9  0xb4b2899c in nsHTMLReflowState (this=0xbfb6bb8c, aPresContext=0x9a007f8, 
    aParentReflowState=@0xbfb6bdac, aFrame=0x9a29b04, 
(gdb) frame 6
#6  0xb4b26868 in nsHTMLReflowState::ComputeContainingBlockRectangle (
    this=0xbfb6bb8c, aPresContext=0x9a007f8, aContainingBlockRS=0x0, 
    aContainingBlockWidth=@0xbfb6baf8, aContainingBlockHeight=@0xbfb6bafc)
    at /opt/joro/firefox/mozilla/layout/generic/nsHTMLReflowState.cpp:1343
1343      aContainingBlockWidth = aContainingBlockRS->mComputedWidth;
(gdb) p aContainingBlockRS
$1 = (const nsHTMLReflowState *) 0x0

Comment 1

[georgi - hopefully not receiving bugspam]

Attachment: crash

Comment 2

[georgi - hopefully not receiving bugspam]

this is dup, sorry.