Closed Bug 373625 Opened 14 years ago Closed 13 years ago

Crash [@ nsCSSFrameConstructor::WipeContainingBlock] with display: inline-table on html and dynamic changes

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

Attached file testcase
See testcase, which crashes on load in current trunk builds.

Talkback ID: TB30155874Y
nsCSSFrameConstructor::WipeContainingBlock  [mozilla/layout/base/nscssframeconstructor.cpp, line 12724]
nsCSSFrameConstructor::ContentInserted  [mozilla/layout/base/nscssframeconstructor.cpp, line 9118]

This regressed between 2007-01-26 and 2007-01-28.
This is when bug 9458 was fixed.

Marking security sensitive for now, please open up this bug if it is not necessary.
No need to be security sensitive, trunk crash only.
Group: security
CC list accessible: false
Not accessible to reporter
Flags: blocking1.9?
This is now worksforme, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a5pre) Gecko/20070517 Minefield/3.0a5pre
Status: NEW → RESOLVED
Closed: 13 years ago
Flags: blocking1.9?
Resolution: --- → WORKSFORME
Crash Signature: [@ nsCSSFrameConstructor::WipeContainingBlock]
You need to log in before you can comment on or make changes to this bug.