Status

()

--
critical
VERIFIED FIXED
12 years ago
12 years ago

People

(Reporter: me, Unassigned)

Tracking

({crash, regression, testcase})

Trunk
x86
Windows XP
crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(2 attachments)

(Reporter)

Description

12 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070123 Minefield/3.0a2pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070123 Minefield/3.0a2pre

Crash and Talkback launches on visiting the URL specified (http://www.namepros.com/).  http://www.altiris.com/Support/Documentation.aspx will also crash similarly.

Talkback ID's:

TB28648278
TB28648258  	
TB28648023

Similar Talkback reports (identical stack signature),

http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=+BasicTableLayoutStrategy%3A%3AComputeColumnIntrinsicWidths+3fe4d46a&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid&rlimit=500

Reproducible: Always

Steps to Reproduce:
1. Visit the URL.  Either http://www.namepros.com/ or http://www.altiris.com/Support/Documentation.aspx  will crash.
2. Crash.
Actual Results:  
The browser crashes and Talkback launches.

Expected Results:  
No crash.
Have you tried a new profile or safe mode?c
Keywords: crash
Created attachment 252573 [details]
stack

With a trunk debug build on Windows I see:
###!!! ASSERTION: bogus result from spanning cell sorter: 'cellData && cellData->IsOrig()', file i:/moz/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 332
###!!! ASSERTION: bogus result from spanning cell sorter: 'cellFrame', file i:/moz/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 333

before the crash. Here's the stack to the crash.
Created attachment 252579 [details]
smaller testcase

This probably isn't minimal (and my knowledge of table code isn't really good enough for me to make "educated" minimization guesses), but it's at a point where I can't seem to remove anything without getting a different crash (that doesn't hit the same assertions).
Keywords: testcase
Backing out the patch in bug 352461 fixes this.
Blocks: 352461
Keywords: regression
I guess the patch from bug 367749 might fix this.
Yeah, this was fixed by the patch for bug 367749.
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Depends on: 367749
Resolution: --- → FIXED
(Reporter)

Comment 7

12 years ago
Verified fix using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070130 Minefield/3.0a2pre.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.