5190 - Tables - Gecko Crashes When a table is root element

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect, P3)

Description

[mle]

Gecko crashes when a table is the root element of a document.
The test case provided is an XML document with a CSS2 defined
table.  The CSS and XML file are shown directly below.  This
test case can be made to work simply by putting a container
element around the element keyboard.

<?xml version="1.0"?>
<?xml-stylesheet href="keytable.css" type="text/css"?>
<!DOCTYPE keyboard [
<!ELEMENT keyboard (row+)>
<!ATTLIST keyboard type CDATA #IMPLIED>
<!ELEMENT row (key+)>
<!ELEMENT key ( (upper, lower) | special )>
<!ELEMENT upper (#PCDATA)>
<!ELEMENT lower (#PCDATA)>
<!ELEMENT special (#PCDATA)>
]>
<keyboard type="dvorak">
<row>
<key><upper>~</upper><lower>`</lower></key>
<key><upper>!</upper><lower>1</lower></key>
<key><upper>@</upper><lower>2</lower></key>
<key><upper>#</upper><lower>3</lower></key>
<key><upper>$</upper><lower>4</lower></key>
<key><upper>%</upper><lower>5</lower></key>
<key><upper>^</upper><lower>6</lower></key>
<key><upper>&amp;</upper><lower>7</lower></key>
<key><upper>*</upper><lower>8</lower></key>
<key><upper>(</upper><lower>9</lower></key>
<key><upper>)</upper><lower>0</lower></key>
<key><upper>£</upper><lower>µ</lower></key>
<key><upper>+</upper><lower>=</lower></key>
</row>
<row>
<key><upper>&quot;</upper><lower>'</lower></key>
<key><upper>&lt;</upper><lower>,</lower></key>
<key><upper>&gt;</upper><lower>.</lower></key>
<key><single>P</single></key>
<key><single>Y</single></key>
<key><single>F</single></key>
<key><single>G</single></key>
<key><single>C</single></key>
<key><single>R</single></key>
<key><single>L</single></key>
<key><upper>?</upper><lower>/</lower></key>
<key><upper>}</upper><lower>{</lower></key>
<key><upper>|</upper><lower>\</lower></key>
</row>
<row>
<key><single>A</single></key>
<key><single>O</single></key>
<key><single>E</single></key>
<key><single>U</single></key>
<key><single>I</single></key>
<key><single>D</single></key>
<key><single>H</single></key>
<key><single>T</single></key>
<key><single>N</single></key>
<key><single>S</single></key>
<key><upper>_</upper><lower>-</lower></key>
<key><special>SHLK</special></key>
<key><special>RET</special></key>
</row>
<row>
<key><special>SHFT</special></key>
<key><upper>:</upper><lower>;</lower></key>
<key><single>Q</single></key>
<key><single>J</single></key>
<key><single>K</single></key>
<key><single>X</single></key>
<key><single>B</single></key>
<key><single>M</single></key>
<key><single>W</single></key>
<key><single>V</single></key>
<key><single>Z</single></key>
<key><special>DEL</special></key>
<key><special>SPC</special></key>
</row>
</keyboard>

keyboard
    {
    display: table;
    font-family: Verdana, Arial, Helvetica, sans-serif;
    font-size: 10pt;
    padding: 10pt;
    padding-top: 5pt;
    color: black;
    background: black;
    empty-cells: show;
    table-layout: auto;
    border-collapse: collapse
    }

row
    {
    display: table-row;
    padding-top: 8px;
    }

key
    {
    display: table-cell;
    cursor:pointer;
    background: #BBB;
    padding-left: 3px;
    padding-right: 3px;
    padding-bottom: 2px;
    margin-right: 2px;
    border: 2px outset #BBB;
    }

upper
    {
    display: inline;
    font-size: 8pt;
    vertical-align:top;
    color: #EEE;
    margin-bottom: auto;
    margin-top: auto;
    }
lower
    {
    display: inline;
    padding: 2px;
    font-weight: bold;
    margin-bottom: auto;
    margin-top: auto;
    }

special
    {
    display: inline;
    font-weight: bold;
    margin-bottom: auto;
    margin-top: auto;
    }

single
    {
    display: inline;
    font-weight: bold;
    margin-bottom: auto;
    margin-top: auto;
    }

Comment 1

[karnaze (gone)]

Nisheeth, I can't get this to load as an xml document, so I can't even get the
crash. Is a table element allowed to be a root element in XML or can we wrap one
of our root elements and a body around it? If not, then I'm sure it won't work
as is.

Comment 2

[Nisheeth Ranjan]

XML does allow the root element to have any kind of style attached to it,
including makeing the root element a table.

I'm attaching the XML and CSS files created from the test case pasted to this
bug report.  Save these files in the same directory and load up the XML file.
You'll get a crash in table code with the following call stack...

nsPageFrame::Reflow(nsPageFrame * const 0x01801780, nsIPresContext & {...},
nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0)
line 42 + 3 bytes
nsTableCellFrame::MapBorderMarginPadding(nsIPresContext * 0x01731190) line 810 +
14 bytes
nsTableCellFrame::DidSetStyleContext(nsTableCellFrame * const 0x01801780,
nsIPresContext * 0x01731190) line 942
nsFrame::SetStyleContext(nsFrame * const 0x01801780, nsIPresContext *
0x01731190, nsIStyleContext * 0x01c6fad8) line 424
nsFrame::Init(nsFrame * const 0x01801780, nsIPresContext & {...}, nsIContent *
0x017f4d5c, nsIFrame * 0x01801260, nsIStyleContext * 0x01c6fad8, nsIFrame *
0x00000000) line 228
nsSplittableFrame::Init(nsSplittableFrame * const 0x01801780, nsIPresContext &
{...}, nsIContent * 0x017f4d5c, nsIFrame * 0x01801260, nsIStyleContext *
0x01c6fad8, nsIFrame * 0x00000000) line 33 + 29 bytes
nsTableCellFrame::Init(nsTableCellFrame * const 0x01801780, nsIPresContext &
{...}, nsIContent * 0x017f4d5c, nsIFrame * 0x01801260, nsIStyleContext *
0x01c6fad8, nsIFrame * 0x00000000) line 64 + 29 bytes
nsCSSFrameConstructor::ConstructTableCellFrameOnly(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4d5c, nsIFrame * 0x01801260,
nsIStyleContext * 0x01c6fad8, nsIFrame * & 0x01801780, nsIFrame * & 0x005ccb78,
nsTableCreator & {...}, int 1) line 1481
nsCSSFrameConstructor::ConstructTableCellFrame(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4d5c, nsIFrame * 0x01801260,
nsIStyleContext * 0x01c6fad8, nsIFrame * & 0x00000000, nsIFrame * & 0x01801780,
nsIFrame * & 0x005ccb78, nsTableCreator & {...}, int 1) line 1427 + 49 bytes
nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, const nsStyleDisplay * 0x01c6fcc8, nsIContent *
0x017f4d5c, nsIFrame * 0x01801260, nsIStyleContext * 0x01c6fad8, int 0,
nsFrameItems & {...}) line 3170 + 55 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4d5c, nsIFrame * 0x01801260,
int 0, nsFrameItems & {...}) line 3482 + 45 bytes
nsCSSFrameConstructor::TableProcessChild(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4d5c, nsIFrame * 0x01801260,
nsIStyleContext * 0x01c5aee0, nsFrameItems & {...}, nsTableCreator & {...}) line
1571 + 30 bytes
nsCSSFrameConstructor::TableProcessChildren(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4bec, nsIFrame * 0x01801260,
nsFrameItems & {...}, nsTableCreator & {...}) line 1538 + 46 bytes
nsCSSFrameConstructor::ConstructTableRowFrameOnly(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4bec, nsIFrame * 0x01801120,
nsIStyleContext * 0x01c5aee0, int 1, nsIFrame * & 0x01801260, nsTableCreator &
{...}) line 1315 + 34 bytes
nsCSSFrameConstructor::ConstructTableRowFrame(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4bec, nsIFrame * 0x01801c40,
nsIStyleContext * 0x016cfcc8, nsIFrame * & 0x01801120, nsIFrame * & 0x01801260,
nsTableCreator & {...}, nsTableList * 0x00000000) line 1286 + 45 bytes
nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, const nsStyleDisplay * 0x016cfeb8, nsIContent *
0x017f4bec, nsIFrame * 0x01801c40, nsIStyleContext * 0x016cfcc8, int 0,
nsFrameItems & {...}) line 3162 + 48 bytes
nsCSSFrameConstructor::ConstructFrame(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f4bec, nsIFrame * 0x01801c40,
int 0, nsFrameItems & {...}) line 3482 + 45 bytes
nsCSSFrameConstructor::ProcessChildren(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f487c, nsIFrame * 0x01801c40,
int 1, nsFrameItems & {...}) line 672 + 35 bytes
nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresContext * 0x01731190,
nsFrameConstructorState & {...}, nsIContent * 0x017f487c, nsIFrame * 0x018015c0,
nsIStyleContext * 0x01c5bdd0, nsIFrame * & 0x01833560) line 1870
nsCSSFrameConstructor::ContentInserted(nsCSSFrameConstructor * const 0x017d3530,
nsIPresContext * 0x01731190, nsIContent * 0x00000000, nsIContent * 0x017f487c,
int 0) line 3929
StyleSetImpl::ContentInserted(StyleSetImpl * const 0x017d3f60, nsIPresContext *
0x01731190, nsIContent * 0x00000000, nsIContent * 0x017f487c, int 0) line 793
PresShell::InitialReflow(PresShell * const 0x017d39b0, int 9120, int 4410) line
854
nsXMLContentSink::StartLayout() line 1528
nsXMLContentSink::DidBuildModel(nsXMLContentSink * const 0x01833ec0, int 1) line
268
CWellFormedDTD::DidBuildModel(CWellFormedDTD * const 0x017d4aa0, unsigned int 0,
int 1, nsIParser * 0x01833250, nsIContentSink * 0x01833ec0) line 289 + 20 bytes
nsParser::DidBuildModel(unsigned int 0) line 463 + 55 bytes
nsParser::ResumeParse(nsIDTD * 0x00000000) line 804
nsParser::EnableParser(int 1) line 540 + 19 bytes
nsXMLContentSink::ResumeParsing(nsXMLContentSink * const 0x01833ec0) line 1591
nsDoneLoadingStyle(nsIUnicharStreamLoader * 0x017d8be0, nsString & {...}, void *
0x017d8b80, unsigned int 0) line 1042
nsUnicharStreamLoader::OnStopBinding(nsUnicharStreamLoader * const 0x017d8be4,
nsIURL * 0x017d8980, unsigned int 0, unsigned short * 0x017da210) line 156 + 31
bytes
nsDocumentBindInfo::OnStopBinding(nsDocumentBindInfo * const 0x017d8c60, nsIURL
* 0x017d8980, unsigned int 0, unsigned short * 0x017da210) line 2128 + 30 bytes
OnStopBindingProxyEvent::HandleEvent(OnStopBindingProxyEvent * const 0x017da1c0)
line 591 + 45 bytes
StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x017da1c4) line 471 + 12
bytes
PL_HandleEvent(PLEvent * 0x017da1c4) line 476 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x016df610) line 437 + 9 bytes
_md_EventReceiverProc(void * 0x0052036e, unsigned int 49364, unsigned int 0,
long 23983632) line 799 + 9 bytes
USER32! 77e71250()

Comment 3

[Nisheeth Ranjan]

Attachment: The XML file

Comment 4

[Nisheeth Ranjan]

Attachment: The CSS file.

Comment 5

[Nisheeth Ranjan]

Save the attachment titled "The XML file" as any file name with the extension
.xml.  Save the attachment titled "The CSS file" as kaytable.css in the same
directory as the XML file.  Load up the XML file in viewer.  You'll see the
crash.

Comment 6

[karnaze (gone)]

This is now fixed but the table only has one row. I filed bug 5790 and assigned
it to Nisheeth because the content model is not correct.

Comment 7

[Christine Hoffman]

Using 6/7 Apprunner, verified bug fixed.