Closed Bug 395575 Opened 17 years ago Closed 17 years ago

Crash [@ nsFrameManager::ReResolveStyleContext] [@ nsStyleContext::AddRef] [@ VerifyStyleTree] with MathML, position: fixed

Categories

(Core :: MathML, defect)

Product:
Core
Component:
MathML
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED WORKSFORME

People

(Reporter: jruderman, Assigned: rbs)

References

Details

(Keywords: crash, testcase, Whiteboard: [sg:critical?])

Crash Data

Attachments

(1 file)

testcase
509 bytes, application/xhtml+xml
Details
Attached file testcase — 
Loading the testcase makes Firefox crash dereferencing 0xddddde05.
Flags: blocking1.9?
Whiteboard: [sg:critical?]
Summary: Crash [@ nsFrameManager::ReResolveStyleContext] [@ nsStyleContext::AddRef] with MathML, position: fixed → Crash [@ nsFrameManager::ReResolveStyleContext] [@ nsStyleContext::AddRef] [@ VerifyStyleTree] with MathML, position: fixed
I see a whole bunch of reflow assertions due to unconstrained widths in that testcase...  Fixing those might be a good first step.  Then again, maybe we're ending up with dead frames for some other reason?
Flags: blocking1.9? → blocking1.9+
No crash on amd64 Linux.
WFM (Mac trunk debug).  No assertions and no crash.
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → WORKSFORME
Flags: in-testsuite?
verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b3pre) Gecko/2007123104 Minefield/3.0b3pre and the testcase from this bug - no crash on testcase

-> Verified
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsFrameManager::ReResolveStyleContext] [@ nsStyleContext::AddRef] [@ VerifyStyleTree]
Group: core-security
Crash Signature: [@ nsFrameManager::ReResolveStyleContext] [@ nsStyleContext::AddRef] [@ VerifyStyleTree] → [@ nsFrameManager::ReResolveStyleContext] [@ nsStyleContext::AddRef] [@ VerifyStyleTree]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: