68391 - page crashes in nsTableCellFrame::MapBorderPadding

Status: VERIFIED DUPLICATE of bug 67864

(Core :: Layout: Tables, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There was a long series of talkback reports showing that the page
http://www.prezentacje.pl/prezentacje/index/index1.htm
crashes with the following stack:

#4  <signal handler called>
#5  0x4150f5f3 in nsTableOuterFrame::IR_TargetIsMe (this=0x86c452c, 
    aPresContext=0xbfffd594, aDesiredSize=@0xbfffd59c, 
    aReflowState=@0x414fe680, aStatus=@0x0)
    at
/builds/seamonkey/mozilla/layout/html/table/src/nsTableOuterFrame.cpp:1167
#6  0x414fe754 in nsTableCellFrame::MapBorderPadding (this=0x86c4690, 
    aPresContext=0x84d1838)
    at
/builds/seamonkey/mozilla/layout/html/table/src/nsTableCellFrame.cpp:1012#7 
0x414fea44 in nsTableCellFrame::DidSetStyleContext (this=0x86c4690, 
    aPresContext=0x84d1838)
    at
/builds/seamonkey/mozilla/layout/html/table/src/nsTableCellFrame.cpp:1132#8 
0x41350dfb in nsFrame::SetStyleContext (this=0x86c4690, 
    aPresContext=0x84d1838, aContext=0x85e9ea8)
    at /builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp:472
#9  0x413508d8 in nsFrame::Init (this=0x86c4690, aPresContext=0x84d1838, 
    aContent=0x86c75f0, aParent=0x86c45ec, aContext=0x85e9ea8, aPrevInFlow=0x0)
    at /builds/seamonkey/mozilla/layout/html/base/src/nsFrame.cpp:326
#10 0x413a0979 in nsSplittableFrame::Init (this=0x86c4690, 
    aPresContext=0x84d1838, aContent=0x86c75f0, aParent=0x86c45ec, 
    aContext=0x85e9ea8, aPrevInFlow=0x0)
    at /builds/seamonkey/mozilla/layout/html/base/src/nsSplittableFrame.cpp:37
#11 0x414fc43d in nsTableCellFrame::Init (this=0x86c4690, 
    aPresContext=0x84d1838, aContent=0x86c75f0, aParent=0x86c45ec, 
    aContext=0x85e9ea8, aPrevInFlow=0x0)
    at /builds/seamonkey/mozilla/layout/html/table/src/nsTableCellFrame.cpp:85
#12 0x41493f95 in nsCSSFrameConstructor::InitAndRestoreFrame (this=0x83cbd70, 
    aPresContext=0x84d1838, aState=@0xbfffe648, aContent=0x86c75f0, 
    aParentFrame=0x86c45ec, aStyleContext=0x85e9ea8, aPrevInFlow=0x0, 
    aNewFrame=0x86c4690)
    at
/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:6640
#13 0x4148b082 in nsCSSFrameConstructor::ConstructTableCellFrame (
    this=0x83cbd70, aPresShell=0x83cbe28, aPresContext=0x84d1838, 
    aState=@0xbfffe648, aContent=0x86c75f0, aParentFrameIn=0x86c45ec, 
    aStyleContext=0x85e9ea8, aTableCreator=@0xbfffe048, aIsPseudo=1, 
    aChildItems=@0xbfffd7b8, aNewCellOuterFrame=@0xbfffe6e4, 
    aNewCellInnerFrame=@0xbfffe6f8, aIsPseudoParent=@0xbfffd7c0)
    at
/builds/seamonkey/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp:2909
...

There's probably something wrong with tableFrame since a call to GetCellPadding
calls the wrong function.

Comment 1

[R.K.Aa.]

the amount of talkbacks were probably because people were testing bug 68281
about exact same URL.

It's a dup of bug 67864, marking this one as such too. Please modify the summary
there if it's incorrect?

*** This bug has been marked as a duplicate of 67864 ***

Comment 2

[Amarendra Hanumanula]

QA contact update

Comment 3

[Amarendra Hanumanula]

 
 The page is not crashing any more.. 
Verifed on Build ID: 2001052213
 OS: RedHat Linux 7.0

Marking as verified