Closed Bug 582138 Opened 14 years ago Closed 14 years ago

Crash [@ nsHTMLEditor::GetElementOrigin] with mixed HTML and MathML table

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla2.0b5
Tracking Flags:
Tracking Status
blocking2.0 --- beta7+

People

(Reporter: jruderman, Assigned: ehsan.akhgari)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files, 1 obsolete file)

testcase (crashes Firefox when loaded)
397 bytes, application/xhtml+xml
Details
crash report (from breakpad + minidump_stackwalk)
44.90 KB, text/plain
Details
For check-in
2.17 KB, patch
Details | Diff | Splinter Review 
      No description provided.
###!!! ASSERTION: Must have frame for destination coordinate system!: 'aOther', file /Users/bzbarsky/mozilla/vanilla/mozilla/layout/generic/nsFrame.cpp, line 3541

And then a null-deref crash.

What looks like the likely-relevant bit of stack:

#2  0x12536a46 in nsIFrame::GetOffsetTo (this=0x162c510, aOther=0x0) at /Users/bzbarsky/mozilla/vanilla/mozilla/layout/generic/nsFrame.cpp:3543
#3  0x12f36e95 in nsHTMLEditor::GetElementOrigin (this=0x11bb400, aElement=0x225341a0, aX=@0xbfffa444, aY=@0xbfffa440) at /Users/bzbarsky/mozilla/vanilla/mozilla/editor/libeditor/html/nsHTMLEditor.cpp:5613
#4  0x12faa630 in nsHTMLEditor::RefreshInlineTableEditingUI (this=0x11bb400) at /Users/bzbarsky/mozilla/vanilla/mozilla/editor/libeditor/html/nsHTMLInlineTableEditor.cpp:239
#5  0x12fabcf5 in nsHTMLEditor::ShowInlineTableEditingUI (this=0x11bb400, aCell=0x225341a0) at /Users/bzbarsky/mozilla/vanilla/mozilla/editor/libeditor/html/nsHTMLInlineTableEditor.cpp:111
#6  0x12f1b848 in nsHTMLEditor::CheckSelectionStateForAnonymousButtons (this=0x11bb400, aSelection=0x22524e40) at /Users/bzbarsky/mozilla/vanilla/mozilla/editor/libeditor/html/nsHTMLAnonymousUtils.cpp:397
#7  0x12f36ca7 in nsHTMLEditor::EndUpdateViewBatch (this=0x11bb400) at /Users/bzbarsky/mozilla/vanilla/mozilla/editor/libeditor/html/nsHTMLEditor.cpp:5637

In particular, GetAbsoluteContainingBlock() returned null.  This can happen if the frame passed to it is inside a mathml subtree, and this caller needs to deal.  When this happens, content under the relevant frame cannot be absolutely positioned.
blocking2.0: --- → ?
Attached patch Patch (v1) (obsolete) — — Splinter Review 
Assignee: nobody → ehsan
Status: NEW → ASSIGNED

        Attachment #469192 -
        Flags: review?(roc)

        Attachment #469192 -
        Flags: approval2.0?

    
    

    
  

      
      
      
      

        Attached patch
          
          
        For check-in
        — 
          — Splinter Review
      

    


  

        Attachment #469192 -
        Attachment is obsolete: true

    
  
Keywords: checkin-needed

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/18bb00bd1564
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Flags: in-testsuite+
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b5
Crash Signature: [@ nsHTMLEditor::GetElementOrigin]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: