The default bug view has changed. See this FAQ.

Crash [@ nsLineLayout::ReflowFrame ]

RESOLVED FIXED in mozilla8

Status

()

Core
Layout
--
critical
RESOLVED FIXED
6 years ago
2 years ago

People

(Reporter: bc, Assigned: mats)

Tracking

(Blocks: 1 bug, {crash, reproducible})

Trunk
mozilla8
x86
All
crash, reproducible
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(firefox6 affected, firefox7 affected, firefox8 affected)

Details

(Whiteboard: [sg:dos] null-pointer access [fixed by bug 578977], crash signature, URL)

(Reporter)

Description

6 years ago
bp-ca4d1671-e4ef-4328-9559-87db32110716

1. http://www.rastlos.com/wohnmobil_2010_ruegen/ruegen_kap_arkona/
2. Crash Beta, Aurora, Nightly - Linux, Mac, Windows

See also bug 358173
(Assignee)

Comment 1

6 years ago
The nsLineLayout::ReflowFrame call is from nsFirstLetterFrame::Reflow
for a first-letter frame that has no child frame.  The frame tree looks
very much like the same situation as in bug 578977.  Applying the patch
in bug 578977 locally fixes it for me.
Test builds will be available shortly at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mpalmgren@mozilla.com-e4de685e7bb3/

The posted stack in bug 358173 looks like a different problem since the
call comes from nsInlineFrame::ReflowInlineFrame.
Assignee: nobody → matspal
Depends on: 578977
Whiteboard: [sg:dos] null-pointer access
(Assignee)

Comment 2

6 years ago
Here's a better build to test (with the latest patch (v3) in bug 578977):
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mpalmgren@mozilla.com-023d6da70368
(Reporter)

Comment 3

6 years ago
Testing the Mac Debug build fixes the crash for me. Mats, do you need me to test the others as well?
(Assignee)

Comment 4

6 years ago
Further testing shouldn't be necessary.  Thanks.

Fixed by bug 578977.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
Whiteboard: [sg:dos] null-pointer access → [sg:dos] null-pointer access [fixed by bug 578977]
Target Milestone: --- → mozilla8
(Assignee)

Comment 5

4 years ago
There's no reduced test here so let's say the tests for bug 578977 is enough.
Flags: in-testsuite? → in-testsuite-
Keywords: testcase-wanted
You need to log in before you can comment on or make changes to this bug.