Closed
Bug 371290
Opened 17 years ago
Closed 17 years ago
[FIX][BC] crash due to cellmap inconsistency [@ nsCellMapColumnIterator::GetNextFrame]
Categories
(Core :: Layout: Tables, defect)
Tracking
()
RESOLVED
FIXED
mozilla1.9alpha3
People
(Reporter: bernd_mozilla, Assigned: bzbarsky)
References
Details
(Keywords: crash, regression, testcase)
Crash Data
Attachments
(2 files)
683 bytes,
text/html
|
Details | |
1.54 KB,
patch
|
bernd_mozilla
:
review+
roc
:
superreview+
|
Details | Diff | Splinter Review |
No description provided.
Summary: [BC] crash due to cellmap inconsistency → [BC] crash due to cellmap inconsistency [@ nsCellMapColumnIterator::GetNextFrame]
Assignee | ||
Comment 2•17 years ago
|
||
So the issue is that the second column has a mNumCellsSpan of 0 by the time we do the first removeChild call.
Assignee | ||
Comment 4•17 years ago
|
||
In this case, there's a dead cell in that column, apparently...
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Attachment #256079 -
Flags: superreview?(roc)
Attachment #256079 -
Flags: review?(bernd_mozilla)
Assignee | ||
Updated•17 years ago
|
Summary: [BC] crash due to cellmap inconsistency [@ nsCellMapColumnIterator::GetNextFrame] → [FIX][BC] crash due to cellmap inconsistency [@ nsCellMapColumnIterator::GetNextFrame]
Target Milestone: --- → mozilla1.9alpha3
Attachment #256079 -
Flags: superreview?(roc) → superreview+
Comment on attachment 256079 [details] [diff] [review] Fix The first change is only code clarification or is there a subtle bug?
Attachment #256079 -
Flags: review?(bernd_mozilla) → review+
Assignee | ||
Comment 6•17 years ago
|
||
There's a subtle bug. Anyone comparing the result to PR_TRUE/PR_FALSE could get wrong answers, anyone assingning the result to a bitfield or a PRPackedBool could get false when the answer is actually true.
Assignee | ||
Comment 7•17 years ago
|
||
Fixed.
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Updated•17 years ago
|
Flags: in-testsuite?
Updated•17 years ago
|
Keywords: regression
Updated•13 years ago
|
Crash Signature: [@ nsCellMapColumnIterator::GetNextFrame]
Comment 9•11 years ago
|
||
Crash test: https://hg.mozilla.org/integration/mozilla-inbound/rev/3e073f7795f7
Flags: in-testsuite? → in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•