Closed Bug 400904 Opened 13 years ago Closed 13 years ago

"ASSERTION: Bogus mOrigCells" and crash [@ nsCellMapColumnIterator::GetNextFrame] with MathML mtr, mtd, rowspan

Categories

(Core :: MathML, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: roc)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, testcase)

Crash Data

Attachments

(1 file)

498 bytes, application/xhtml+xml
Details
Attached file testcase
Loading the testcase triggers an assertion and a crash:

###!!! ASSERTION: Bogus mOrigCells?: 'mCurMapRow < mCurMapRelevantRowCount', file /Users/jruderman/trunk/mozilla/layout/tables/nsCellMap.cpp, line 2796

Crash [@ nsCellMapColumnIterator::GetNextFrame]
The frame tree here is bogus (doesn't match the cellmap data).  The patch in bug 399940 fixes it.
Blocks: 397518
Depends on: 399940
Nothing bad happens when I load the testcase now.  FIXED by the patch in bug 399940.
Assignee: rbs → roc
Flags: in-testsuite?
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Crashtest checked in.
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsCellMapColumnIterator::GetNextFrame]
You need to log in before you can comment on or make changes to this bug.