368011 - Crash on visiting URL's

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Jackie Liu]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070123 Minefield/3.0a2pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070123 Minefield/3.0a2pre

Crash and Talkback launches on visiting the URL specified (http://www.namepros.com/).  http://www.altiris.com/Support/Documentation.aspx will also crash similarly.

Talkback ID's:

TB28648278
TB28648258  	
TB28648023

Similar Talkback reports (identical stack signature),

http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=+BasicTableLayoutStrategy%3A%3AComputeColumnIntrinsicWidths+3fe4d46a&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=500

Reproducible: Always

Steps to Reproduce:
1. Visit the URL.  Either http://www.namepros.com/ or http://www.altiris.com/Support/Documentation.aspx  will crash.
2. Crash.
Actual Results:  
The browser crashes and Talkback launches.

Expected Results:  
No crash.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

Have you tried a new profile or safe mode?c

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Attachment: stack

With a trunk debug build on Windows I see:
###!!! ASSERTION: bogus result from spanning cell sorter: 'cellData && cellData->IsOrig()', file i:/moz/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 332
###!!! ASSERTION: bogus result from spanning cell sorter: 'cellFrame', file i:/moz/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 333

before the crash. Here's the stack to the crash.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Attachment: smaller testcase

This probably isn't minimal (and my knowledge of table code isn't really good enough for me to make "educated" minimization guesses), but it's at a point where I can't seem to remove anything without getting a different crash (that doesn't hit the same assertions).

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Backing out the patch in bug 352461 fixes this.

Comment 5

[Martijn Wargers (dead)]

I guess the patch from bug 367749 might fix this.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Yeah, this was fixed by the patch for bug 367749.

Comment 7

[Jackie Liu]

Verified fix using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070130 Minefield/3.0a2pre.