457115 - Crash [@ nsFrame::MarkIntrinsicWidthsDirty] with table displays and setting display: none on body

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes directly or after a few reloads.

This seems to have regressed between 2008-08-28 and 2008-09-01:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2008-08-28+04%3A00%3A00&enddate=2008-09-01+09%3A00%3A00

In a debug build I see this assertion when loading the testcase:
###!!! ASSERTION: expected only one child frame: '!aFrameList->GetNextSibling()'
, file c:/mozilla-build-1.3/mozilla-central/layout/tables/nsTableFrame.cpp, line
 2303

http://crash-stats.mozilla.com/report/index/e92222ee-8b52-11dd-85b1-0013211cbf8a
0  	xul.dll  	nsFrame::MarkIntrinsicWidthsDirty  	 layout/generic/nsFrame.cpp:2886
1 	xul.dll 	PresShell::FrameNeedsReflow 	layout/base/nsPresShell.cpp:3228
2 	xul.dll 	nsBlockFrame::RemoveFrame 	layout/generic/nsBlockFrame.cpp:5043
3 	xul.dll 	nsCSSFrameConstructor::ContentRemoved 	layout/base/nsCSSFrameConstructor.cpp:9457
4 	xul.dll 	nsCSSFrameConstructor::RecreateFramesForContent 	layout/base/nsCSSFrameConstructor.cpp:11080
5 	xul.dll 	xul.dll@0x305848 	
6 	xul.dll 	nsCSSFrameConstructor::ProcessOneRestyle 	layout/base/nsCSSFrameConstructor.cpp:13217
7 	xul.dll 	nsCSSFrameConstructor::ProcessPendingRestyles 	layout/base/nsCSSFrameConstructor.cpp:13311
8 	xul.dll 	PresShell::DoFlushPendingNotifications 	layout/base/nsPresShell.cpp:4538
9 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4502
10 	xul.dll 	nsCSSFrameConstructor::RestyleEvent::Run 	layout/base/nsCSSFrameConstructor.cpp:13384
11 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:510
12 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
13 	nspr4.dll 	PR_GetEnv 	
14 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:87
15 	firefox.exe 	firefox.exe@0x2197 	
16 	kernel32.dll 	BaseProcessStart

Comment 1

[Bernd]

this is wfm in my debug build with the patch from bug 456041

Comment 2

[Bernd]

taking the  bug

Comment 3

[Bernd]

this is fixed by the checkin for bug 456041, the crashtest got checked in there.

Comment 4

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080928204134 Minefield/3.1b1pre