45856 - Empty <deck/> or <tabpanel/> element with flex="1" crashes.

Status: VERIFIED FIXED

(Core :: XUL, defect, P3)

Description

[Martijn Pieters]

An empty <deck/> element, with flex="1" set on it, causes Mozilla to crash on
loading it. Adding a <box/> as a child to the element avoids the crash. The same
goes for <tabpanel> which I assume is based on deck internally.

Comment 1

[Martijn Pieters]

Attachment: Testcase

Comment 2

[Martijn Pieters]

To reproduce:
1/ download testcase and save in chrome/packages/core/test/content/11572.xul
(create path if necessary).
2/ Fire up Mozilla with mozilla -chrome chrome://test/content/11572.xul
3/ Crash

Expected a window with a white background. You canmodify the XUL to read

<deck flex="1">
  <box/>
</deck>

(from a simple <deck flex="1"/>) and Mozilla will not crash.

Comment 3

[Martijn Pieters]

Oops, forgot: This is build ID 2000071810.

Comment 4

[John Morrison]

per trudelle, moving all evaughan's non-nsbeta3+ bugs to Future milestone. 
martijn -- I assume you can live with the workaround.

Comment 5

[Martijn Pieters]

Well, I don't mind this one so much. 

There is another bug (which I still have to file), where you can't dynamically
change the contents of the deck; changing the index won't bring up such
dynamically added content. The workaround for tthat one is adding an enormous
number of static boxes..

Comment 6

[Eric Vaughan]

fixed

Comment 7

[John Morrison]

Hrm ... not crashing in 2001011021 win2k/linux, but then again, wasn't crashing 
with older builds either (e.g. M18). At any rate ...