57010 - possible crash lurking in table frame construction code

Status: RESOLVED WORKSFORME

(Core :: Layout: Tables, defect, P2)

Description

[buster]

spun off of bug 56563.
In that bug, http://www.ex-mozilla.org/date.html crashes during an incremntal 
reflow because the frame model is screwed up.  It looks like this:
TableOuter(table)
  Table(table)
    Inline(sh)
      Inline(sh)

It got this way because the parser didn't correctly move <SH> out of the table 
into the table's parent.
However, I believe it's also possible to get into this situation via the DOM.  
I haven't coded up a test case, but it shouldn't be hard to do.  

So this bug is about making sure a legal frame model gets created for the table.

Comment 1

[buster]

I don't think we need to worry about this for RTM.  It needs investigation, and 
a test case.

Comment 2

[Amarendra Hanumanula]

QA contact update

Comment 3

[Chris Waterson]

See bug 72360, which ends up creating an invalid frame model. karnaze, I think
that we should definitely spend some time figuring out how to avoid constructing
invalid frame models in the face of malicious CSS and/or DOM operations.

Comment 4

[karnaze (gone)]

Removing crash keyword, since there is no url or testcase demonstrating a crash.

Comment 5

[Sam J. Fleet]

Since there is no URL and no testcase that demostrate a crash.  There isn't any
more specific information that would give us a head start.  

Reporter: Do you know the step-by-step events that would trigger the crash?

Comment 6

[karnaze (gone)]

mass reassign to default owner

Comment 7

[Jason Barnabe (np)]

No URL or testcase to reproduce. Marking worksforme.