370692 - [FIX]Crash [@ nsCellMapColumnIterator::GetNextFrame] with MathML mtr, rowspan

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:
* ###!!! ASSERTION: Bogus mOrigCells?: 'mCurMapRow < mCurMapRelevantRowCount', file /Users/jruderman/trunk/mozilla/layout/tables/nsCellMap.cpp, line 2792
* Crash [@ nsCellMapColumnIterator::GetNextFrame]

This happens both with and without the patch in bug 370586 comment 5.

Comment 1

[Bernd]

> This happens both with and without the patch in bug 370586 comment 5.

but the issue looks very similiar, rowspan inherited down to the mtd, which reports 10 when asked for its content rowspan

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: non-crashing testcase

Comment 3

[Boris Zbarsky [:bzbarsky]]

Bernd is right -- this is just like bug 370586, but in copy/pasted and slightly different code.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

I'd love to write a reftest for the colspan too, but I can't get it to misbehave... ;)

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Same as diff -w

Comment 6

[rbs]

Comment on attachment 255643 [details] [diff] [review]
Same as diff -w

r+sr=rbs

Comment 7

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 8

[Jeff Walden [:Waldo]]

http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&subdir=mozilla/layout/reftests&command=DIFF_FRAMESET&file=reftest.list&rev1=1.54&rev2=1.55&root=/cvsroot

If someone can write the test mentioned in comment 4, that'd be nice too, but this covers most of the functionality, from what I can tell -- open a separate bug for it.