371269 - Crash [@ IsContinuationPlaceholder] with testcase, using overflow:scroll, display:list-item and textZoom

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

To see the crash, you need to download the testcase to your computer, because of the use of enhanced privileges.

Talkback ID: TB29571060H
IsContinuationPlaceholder  [mozilla/layout/generic/nsblockframe.cpp, line 592]
nsBlockFrame::ReflowInlineFrames  [mozilla/layout/generic/nsblockframe.cpp, line 3084]

This sort of regressed between 2006-12-07 and 2006-12-08. Before, the testcase lets Mozilla freeze, after, Mozilla crashes.

I'm filing this type of bug (with textzoom and crashing) as security sensitive, if that's not necessary, then please open the bug up.

Comment 1

[Mats Palmgren (inactive)]

I can't reproduce the crash on Linux.

Comment 2

[Martijn Wargers (dead)]

The testcase became wfm between 2007-03-04 and 2007-03-05:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-03-04+04&maxdate=2007-03-05+07&cvsroot=%2Fcvsroot
I guess fixed somehow by bug 363253?

So mark it fixed by bug 363253?

Comment 3

[Martijn Wargers (dead)]

Marking it fixed by bug 363253.

Comment 4

[chris hofmann]

bug 363253 didn't make it to the branch as far as I can tell, but I don't see the crash went running the test case locally using : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/2007030919 Firefox/2.0.0.3

maybe fixed by another bug that also made it to the branch?

Comment 5

[Martijn Wargers (dead)]

The testcase hangs for me on the branch, it doesn't crash, if you want to open up this bug, that's fine by me.