373544 - Crash [@ nsFrameManager::UnregisterPlaceholderFrame ] with mixed mathml/html/xul testcase and changing float

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which usually crashes Mozilla on load. If it doesn't crash directly, try reloading it a few times.

Talkback ID: TB30129252E
nsFrameManager::UnregisterPlaceholderFrame  [mozilla/layout/base/nsframemanager.cpp, line 537]
nsCSSFrameConstructor::RecreateFramesForContent  [mozilla/layout/base/nscssframeconstructor.cpp, line 11123]
nsCSSFrameConstructor::RestyleElement  [mozilla/layout/base/nscssframeconstructor.cpp, line 10000]
0x02a97a70
0x748b5600

This seems to have regressed on trunk between 2006-08-17 and 2006-08-18:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-08-17+04&maxdate=2006-08-18+06&cvsroot=%2Fcvsroot
I guess this could be a regression from bug 348688, somehow. But the patch from that bug was also checked in on branch.
I don't see this crash happening on the latest 1.8.1 branch, though.

Comment 1

[Martijn Wargers (dead)]

This doesn't crash on branch, so no need to be security sensitive.

Comment 2

[Martijn Wargers (dead)]

This is now worksforme, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070417 Minefield/3.0a4pre