Closed Bug 374420 Opened 17 years ago Closed 17 years ago

Crash [@ nsHTMLReflowState::GetNearestContainingBlock] with testcase using generated content, xbl and mathml

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: martijn.martijn, Assigned: martijn.martijn)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

Attached file testcase
See testcase, which crashes current trunk builds 400ms after load.
This seems to have regressed between 2007-01-30 and 2007-01-31:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-01-30+04&maxdate=2007-01-31+07&cvsroot=%2Fcvsroot
I guess this is a regression from bug 339128, somehow.
Not sure if this is a tables bug, a mathml bug, or an xbl bug.

Talkback ID: TB30365748E
nsHTMLReflowState::GetNearestContainingBlock  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 563]
nsHTMLReflowState::InitAbsoluteConstraints  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 950]
nsHTMLReflowState::InitConstraints  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 1642]
nsHTMLReflowState::Init  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 251]
nsHTMLReflowState::nsHTMLReflowState  [mozilla/layout/generic/nshtmlreflowstate.cpp, line 179]
nsAbsoluteContainingBlock::ReflowAbsoluteFrame  [mozilla/layout/generic/nsabsolutecontainingblock.cpp, line 367]
Ok, the testcase doesn't crash online, you have to download it to your computer, or -after you visited the testcase- go offline and visit the testcase again to get the crash.
I can't seem to reproduce the crash here...
Athough that build had the patch for bug 374193 in it...  That might matter.
Depends on: 374193
Indeed fixed by bug 374193, the testcase doesn't crash anymore using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a4pre) Gecko/20070411 Minefield/3.0a4pre
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
Depends on: 381607
No longer depends on: 381607
Crash Signature: [@ nsHTMLReflowState::GetNearestContainingBlock]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: