Closed Bug 240854 Opened 21 years ago Closed 21 years ago

M17beta crash in paint code [@ nsTableFrame::GetRowGroupFrame ]

Categories

(Core :: Layout: Tables, defect)

Product:
Core
Component:
Layout: Tables
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: bernd_mozilla, Assigned: bernd_mozilla)

References

Details

(4 keywords)

Crash Data

Attachments

(3 files)

crash testcase
(deleted), text/html
Details
band_aid patch
(deleted), patch
bzbarsky
: review+
bzbarsky
: superreview+
asa
: approval1.7+
Details | Diff | Splinter Review
TB24618G stacktrace
(deleted), text/plain
Details
1. load the attached testcase 2. close the window 3. watch talkback comming up.
Attached file crash testcase (deleted) —
Blocks: 237078
TalkbackID: TB24593W Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040415 crashing is more fun now, as TalkbackID cab be copied and pasted again ;-)
TalkbackID: TB24618G Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7b) Gecko/20040316 crashed using Mozilla 1.7b Release, Mozilla 1.4.1 or Mozilla 1.6 were showing the testcase without crashing.
This crash is in the table background painter code that got checkied in before 1.7b and is enabled now only in the standards rendering mode.
Regressed: BuildID 2004030808 is working, BuildID 2004030909 is crashing.
This SUCKS, the table paint code expects for table col painting that the col frames don't ly about their position in the cellmap and so on. But this is sooo broken.
Attached patch band_aid patch (deleted) — — Splinter Review
Comment on attachment 146415 [details] [diff] [review] band_aid patch r+sr=bzbarsky, but please add a nice XXX comment on the fact that GetColIndex() sometimes returns totally bogus things. Are you going to fix the real problem here, or file a followup?
Attachment #146415 - Flags: superreview+
Attachment #146415 - Flags: review+
Attachment #146415 - Flags: approval1.7?
taking, fix was checked in into trunk. I would like to have the wallpaper first in the branch and then when I have a real fix have it first on trunk and then on branch.
Assignee: nobody → bernd_mozilla
Attached file TB24618G stacktrace (deleted) —
Severity: normal → critical
Keywords: testcase
Summary: crash in paint code → crash in paint code [@ nsTableFrame::GetRowGroupFrame ]
Summary: crash in paint code [@ nsTableFrame::GetRowGroupFrame ] → M17beta crash in paint code [@ nsTableFrame::GetRowGroupFrame ]
Comment on attachment 146415 [details] [diff] [review] band_aid patch a=asa (on behalf of drivers) for checkin to 1.7
Attachment #146415 - Flags: approval1.7? → approval1.7+
the fix is checked in into trunk and branch the real core fix will be incorporated into the patch in bug 238999
marking so
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → FIXED
Keywords: fixed1.7
Verified fixed based on latest Talkback data for MozillaTrunk and Mozilla 1.7 rc1.
Status: RESOLVED → VERIFIED
Keywords: topcrash
Keywords: fixed1.7 → verified1.7
layout/tables/crashtests/240854-1.html http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3
Flags: in-testsuite+
Crash Signature: [@ nsTableFrame::GetRowGroupFrame ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: