"ASSERTION: Bogus mOrigCells" and crash [@ nsCellMapColumnIterator::GetNextFrame] with MathML mtr, mtd, rowspan

RESOLVED FIXED

Status

()

Core
MathML
--
critical
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Assigned: roc)

Tracking

(Blocks: 1 bug, {assertion, crash, testcase})

Trunk
x86
Mac OS X
assertion, crash, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

498 bytes, application/xhtml+xml
Details
(Reporter)

Description

10 years ago
Created attachment 285947 [details]
testcase

Loading the testcase triggers an assertion and a crash:

###!!! ASSERTION: Bogus mOrigCells?: 'mCurMapRow < mCurMapRelevantRowCount', file /Users/jruderman/trunk/mozilla/layout/tables/nsCellMap.cpp, line 2796

Crash [@ nsCellMapColumnIterator::GetNextFrame]
The frame tree here is bogus (doesn't match the cellmap data).  The patch in bug 399940 fixes it.
Blocks: 397518
Depends on: 399940
(Reporter)

Comment 2

10 years ago
Nothing bad happens when I load the testcase now.  FIXED by the patch in bug 399940.
Assignee: rbs → roc
Flags: in-testsuite?
(Reporter)

Updated

10 years ago
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
(Reporter)

Comment 3

10 years ago
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsCellMapColumnIterator::GetNextFrame]
You need to log in before you can comment on or make changes to this bug.