Composer ROWSPAN problem

VERIFIED FIXED in M12

Status

MozillaClassic
Composer
P1
major
VERIFIED FIXED
20 years ago
18 years ago

People

(Reporter: Jukka Santala, Assigned: Kathleen Brade)

Tracking

1998-03-31
x86
Windows NT

Details

(Reporter)

Description

20 years ago
Created by Jukka Santala (donwulff@iki.fi) on Tuesday, April 7, 1998 5:08:08 AM PDT
Additional Details :
Sometimes when the ROWSPAN attribute in a table has been
set past the number of rows in a table, Composer will end
up with memory corruption. This is due to a function using
the number of rows to initialize an array.

In particular, the following HTML code will demonstrate:

<TABLE BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="100%">
<TR><TD BGCOLOR="#000000" VALIGN=TOP ROWSPAN=2>
    <IMG SRC="images/mozilla-banner.jpg"
    ALT="" BORDER=0 USEMAP="#banner"
    WIDTH=600 HEIGHT=50 VSPACE=0 HSPACE=0>
</TD></TR></TABLE>

From a netscape rep. suggested to use a re-sizable array.
From personal view over the code, it seems that the extra
array positions arne''t actually needed since the spanned
rows don''t get visible, though, so ending the loop once
the existing rows have been processed is another
possibility. It''s also within possibility that the row
counter method needs fixing; need to dig deeper into the
code.

The following patch solved the problem for debugging:

diff --unified --recursive mozorg/ns/lib/layout/edtbuf.cpp
mozilla/ns/lib/layout/edtbuf.cpp
--- mozorg/ns/lib/layout/edtbuf.cpp	Mon Mar 30 17:55:37
1998
+++ mozilla/ns/lib/layout/edtbuf.cpp	Sat Apr 04 21:35:37
1998
@@ -1860,8 +1860,11 @@
                         //  then it
will cause extra columns in following row(s)
                         if( iRowSpan > 1 )
                         {
-                            for( intn j = 1; j < iRowSpan;
j++ )
-                                ExtraColumns[iRow+j] +=
iColSpan;
+                            for( intn j = 1; j < iRowSpan;
j++ ) {
+
if((iRow+j)>=iRows) XP_TRACE(("CEditBuffer::FixupTableData()
inconsistency!"));
+
else ExtraColumns[iRow+j] += iColSpan;
+
XP_TRACE(("Did stuff"));
+							}
                         }
                         //  Save actual location and size
data
                         EDT_TableCellData *pCellData =
pEdCell->GetData();

This patch is incomplete, as it doesn''t deal with the
side-effects of the loop which may do other nasty stuff,
however it''s useful in debugging the problem for me.
Updated by   (brade@netscape.com) on Thursday, April 16, 1998 8:52:10 PM PDT
Additional Details :
Reassign bug to myself since I'm the owner of this file.
I'm guessing that this is really cross-platform (ALL) but I haven't tested it on
any platform to confirm yet.

Updated

20 years ago
Status: NEW → RESOLVED
Last Resolved: 20 years ago
Resolution: --- → FIXED

Updated

19 years ago
QA Contact: 2947

Comment 1

19 years ago
Greg, please have someone verify this -- thanks

Updated

19 years ago
QA Contact: 2947 → 2792

Comment 2

19 years ago
eli set as qa contact, eli can you verify this asap?

Comment 3

19 years ago
Verify against what? We don't have a composer 5.0 right now.

Updated

19 years ago
Status: RESOLVED → VERIFIED

Comment 4

19 years ago
old code base -- marking as verified

Updated

19 years ago
QA Contact: 2792

Comment 5

18 years ago
setting to an approximate milestone so it can be off of the no TFV list
Target Milestone: --- → M12
You need to log in before you can comment on or make changes to this bug.