Crash [@ nsCSSFrameConstructor::WipeContainingBlock] with display: inline-table on html and dynamic changes

RESOLVED WORKSFORME

Status

()

Core
Layout
--
critical
RESOLVED WORKSFORME
11 years ago
7 years ago

People

(Reporter: Martijn Wargers (zombie), Unassigned)

Tracking

({crash, testcase})

Trunk
x86
Windows XP
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

11 years ago
Created attachment 258283 [details]
testcase

See testcase, which crashes on load in current trunk builds.

Talkback ID: TB30155874Y
nsCSSFrameConstructor::WipeContainingBlock  [mozilla/layout/base/nscssframeconstructor.cpp, line 12724]
nsCSSFrameConstructor::ContentInserted  [mozilla/layout/base/nscssframeconstructor.cpp, line 9118]

This regressed between 2007-01-26 and 2007-01-28.
This is when bug 9458 was fixed.

Marking security sensitive for now, please open up this bug if it is not necessary.
(Reporter)

Comment 1

11 years ago
No need to be security sensitive, trunk crash only.
Group: security
CC list accessible: false
Not accessible to reporter
(Reporter)

Updated

11 years ago
Flags: blocking1.9?
(Reporter)

Comment 2

11 years ago
This is now worksforme, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070517 Minefield/3.0a5pre
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Flags: blocking1.9?
Resolution: --- → WORKSFORME
(Assignee)

Updated

7 years ago
Crash Signature: [@ nsCSSFrameConstructor::WipeContainingBlock]
You need to log in before you can comment on or make changes to this bug.