374420 - Crash [@ nsHTMLReflowState::GetNearestContainingBlock] with testcase using generated content, xbl and mathml

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk builds 400ms after load.
This seems to have regressed between 2007-01-30 and 2007-01-31:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-01-30+04&maxdate=2007-01-31+07&cvsroot=%2Fcvsroot
I guess this is a regression from bug 339128, somehow.
Not sure if this is a tables bug, a mathml bug, or an xbl bug.

Talkback ID: TB30365748E
nsHTMLReflowState::GetNearestContainingBlock  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 563]
nsHTMLReflowState::InitAbsoluteConstraints  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 950]
nsHTMLReflowState::InitConstraints  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 1642]
nsHTMLReflowState::Init  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 251]
nsHTMLReflowState::nsHTMLReflowState  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 179]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame  [mozilla/layout/generic/nsabsolutecontainingblock.cpp, line 367]

Comment 1

[Martijn Wargers (dead)]

Ok, the testcase doesn't crash online, you have to download it to your computer, or -after you visited the testcase- go offline and visit the testcase again to get the crash.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I can't seem to reproduce the crash here...

Comment 3

[Boris Zbarsky [:bzbarsky]]

Athough that build had the patch for bug 374193 in it...  That might matter.

Comment 4

[Martijn Wargers (dead)]

Indeed fixed by bug 374193, the testcase doesn't crash anymore using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070411 Minefield/3.0a4pre

Comment 5

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d9381ddabf19

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d9381ddabf19