368013 - Crash [@ nsCellMapColumnIterator::GetNextFrame]

Status: RESOLVED DUPLICATE of bug 367749

(Core :: Layout, defect)

Description

[Ryuichi KUBUKI]

The build ID in the talkback is that of the talkback client, the correct ID is 2007012319 . Reproducible always at the URL.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a2pre) Gecko/20070123 Minefield/3.0a2pre ID:2007012319 [cairo]


TB28649510W

Stack Signature	 txKeyValueHash::Init 4e976835
Product ID	FirefoxTrunk
Build ID	2007012004
Trigger Time	2007-01-23 19:59:47.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (0028d892)
URL visited	
User Comments	SSL
Since Last Crash	11 sec
Total Uptime	183362 sec
Trigger Reason	Access violation
Source File, Line No.	e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\content\xslt\src\xslt\txkeyfunctioncall.cpp, line 155
Stack Trace 	
txKeyValueHash::Init  [mozilla\content\xslt\src\xslt\txkeyfunctioncall.cpp, line 155]
nsCellMap::ExpandWithCells  [mozilla\layout\tables\nscellmap.cpp, line 1778]
BasicTableLayoutStrategy::ComputeIntrinsicWidths  [mozilla\layout\tables\basictablelayoutstrategy.cpp, line 587]

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Looks like nsCellMap::ExpandWithCells is jumping to an invalid address here.

Would be great if you could attach a testcase.

Comment 2

[Bernd]

the whole stack is bogus

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/tables/BasicTableLayoutStrategy.cpp&mark=587&rev=#587
does not call ExpandWithCells

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Attachment: stack

With this testcase I see the following assertions (w32 debug trunk build):
###!!! ASSERTION: Bogus mOrigCells?: 'mRow < mCurMapRowCount', file i:/moz/mozilla/layout/tables/nsCellMap.cpp, line 2747
###!!! ASSERTION: invalid array index: 'i < Length()', file i:\moz\mozilla\ff\dist\include\xpcom\nsTArray.h, line 327

mHdr is 0xcdcdcdcd in nsTArray_base::Length().

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Attachment: minimized testcase

Comment 5

[:Gavin Sharp [email: [e-mail]]]

Backing out the patch in bug 352461 fixes this.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Timeless tells me he thinks this is a dupe of bug 367755, but I can't see that bug.

Comment 7

[Martijn Wargers (dead)]

Probably the same as bug 367749. Talkback wasn't working for a while so that bug didn't have a stacktrace yet, and I forgot to put it on later, sorry.

Comment 8

[timeless]

gavin didn't tell me that he couldn't see that bug.

or i was asleep and missed that part.

Comment 9

[Boris Zbarsky [:bzbarsky]]

Fixed by patch in bug 326877.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Er.... wrong bug number.  I _meant_ bug 367749.

Comment 11

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/dd0f3b9a5ce4

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/dd0f3b9a5ce4