995112 - crash in mozalloc_abort(char const*) | Abort | NS_DebugBreak | nsTableFrame::RegisterPositionedTablePart(nsIFrame*)

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Martijn Wargers (dead)]

Attachment: crash1.htm

See testcase, which crashes current trunk build on print preview.
The testcase contains this:
<div style="display: table-footer-group; page-break-before: left; transform: scale(1); ">m</div>
<div style="display: table-cell; "></div>


This bug was filed from the Socorro interface and is 
report bp-7764e943-c9d4-48e9-b77d-aac622140411.
=============================================================
0 	libmozalloc.dylib 	mozalloc_abort(char const*) 	memory/mozalloc/mozalloc_abort.cpp
1 	XUL 	Abort 	xpcom/base/nsDebugImpl.cpp
2 	XUL 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
3 	XUL 	nsTableFrame::RegisterPositionedTablePart(nsIFrame*) 	layout/tables/nsTableFrame.cpp
4 	XUL 	nsCSSFrameConstructor::CreateContinuingTableFrame(nsIPresShell*, nsPresContext*, nsIFrame*, nsIFrame*, nsIContent*, nsStyleContext*) 	layout/base/nsCSSFrameConstructor.cpp
5 	XUL 	nsCSSFrameConstructor::CreateContinuingFrame(nsPresContext*, nsIFrame*, nsIFrame*, bool) 	layout/base/nsCSSFrameConstructor.cpp
6 	XUL 	nsCSSFrameConstructor::CreateContinuingOuterTableFrame(nsIPresShell*, nsPresContext*, nsIFrame*, nsIFrame*, nsIContent*, nsStyleContext*) 	layout/base/nsCSSFrameConstructor.cpp
7 	XUL 	nsCSSFrameConstructor::CreateContinuingFrame(nsPresContext*, nsIFrame*, nsIFrame*, bool) 	layout/base/nsCSSFrameConstructor.cpp
8 	XUL 	nsBlockFrame::ReflowBlockFrame(nsBlockReflowState&, nsLineList_iterator, bool*) 	layout/generic/nsBlockFrame.cpp
9 	XUL 	nsBlockFrame::ReflowDirtyLines(nsBlockReflowState&) 	layout/generic/nsBlockFrame.cpp
10 	XUL 	nsBlockFrame::Reflow(nsPresContext*, nsHTMLReflowMetrics&, nsHTMLReflowState const&, unsigned int&) 	layout/generic/nsBlockFrame.cpp

Comment 1

[Mats Palmgren (inactive)]

Attachment: frame dump in Print Preview

Comment 2

[Mats Palmgren (inactive)]

WFM in ASAN Opt build, and no assertions in a regular debug build.  Both on Linux64.

I think we can close this bug and open a new one on the rendering error.
I get two pages with an "m" on each page.  That doesn't seem right at first glance.

Can anyone else still reproduce the crash?

Comment 3

[Martijn Wargers (dead)]

Indeed, I can't reproduce anymore in current trunk build.
I filed a follow-up bug on the rendering error on print preview, it's bug 1135786.