426708 - crash at nsRect::nsRect(const &nsRect)

Status: RESOLVED FIXED

(Core :: Layout: Tables, defect)

Description

[Masahiro YAMADA]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008040112 Minefield/3.0pre
Build Identifier: 

When moving caret with shift+down arrow key in left textarea of http://www.excite.co.jp/world/ with Fx Trunk, 
it crashes.




Reproducible: Always

Steps to Reproduce:
1.Go to http://www.excite.co.jp/world/
2.click left textarea (it contains two textarea)
3.hit Shift + Down arrow. or hit down arrow key until caret goes to tail of content of textarea.

Actual Results:  
Browser will crash.

Expected Results:  
Browser should not crash.

When using debug build,

###!!! ASSERTION: cellmap is lying: 'frame', file d:/moz-src/mozilla/layout/tabl
es/nsTableRowGroupFrame.cpp, line 1743
is displayed before crash. So, crash is caused by null pointer dereference on
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/tables/nsTableRowGroupFrame.cpp&rev=3.404#1752
  while (n--) {
    nsRect rect = frame->GetRect();  <-- here!!

Workaround:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/layout/tables/nsTableRowGroupFrame.cpp&rev=3.404#1751

- while (n--) {
+ while ((n--) && frame) {
    nsRect rect = frame->GetRect();

Comment 1

[Masahiro YAMADA]

Regression window is

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv:1.9b5pre) Gecko/2008032620
Minefield/3.0pre  --- No crash

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv:1.9b5pre) Gecko/2008032622
Minefield/3.0pre  --- Crash

Comment 2

[Masahiro YAMADA]

Attachment: workaround written in comment #0

Comment 3

[Andreas Premstaller]

Confirmed with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008040112 Minefield/3.0pre

May be related with the check-in to bug 423514 (2008-03-26 22:03).

Comment 4

[Bernd]

excellent diagnostic

Comment 5

[Bernd]

Attachment: patch

Thats the same as the previous bug, I just did not see it

Comment 6

[Atsushi Sakai]

Attachment: testcase

minimal testcase

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 313329 [details] [diff] [review]
patch

Please make sure to land the crashtest.

Comment 8

[Bernd]

Attachment: basic table structure to crash

Its difficult to get this crashed without interaction.

Comment 9

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 313329 [details] [diff] [review]
patch

Like bz said, make sure that test gets landed as well.

Comment 10

[Bernd]

Landing the test is possible but does not make sense as it requires user interaction. So I did not land it. What is needed here is test that crashes without user interaction. If somebody can easily craft such a test case I will certainly check it in.