The following XML snippet crashes the viewer: <?xml version="1.0"?> <window xmlns:html="http://www.w3.org/TR/REC-html40"> <window xmlns:xul ="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> <!DOCTYPE window> <window> <xul:toolbox> <xul:toolbar> <html:span style="display: table-cell"> <html:button cmd="nsCmd:BrowserBack" style="background-color:rgb(192,192,192);"> <html:img src="resource:/res/toolbar/TB_Back.gif"/><html:BR/>Back </html:button> </html:span> <html:span style="display: table-cell"> <html:input style="width:325px;"></html:input> </html:span> </xul:toolbar> </xul:toolbox> </window> The stack trace is: nsDebug::PreCondition(char * 0x006aac78, char * 0x006aac50, char * 0x006aac1c, int 574) line 112 + 13 bytes nsTableFrame::GetEffectiveRowSpan(int 0, nsTableCellFrame * 0x012c2120) line 574 + 51 bytes nsTableRowFrame::PlaceChild(nsIPresContext & {...}, RowReflowState & {...}, nsIFrame * 0x012c2120, const nsRect & {...}, nsSize * 0x0012c69c, nsSize * 0x0012c484) line 437 + 31 bytes nsTableRowFrame::InitialReflow(nsTableRowFrame * const 0x012c1f20, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowReflowState & {...}, unsigned int & 0, nsTableCellFrame * 0x00000000, int 1) line 820 nsTableRowFrame::Reflow(nsTableRowFrame * const 0x012c1f24, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1393 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x012c1f20, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableRowGroupFrame::ReflowMappedChildren(nsTableRowGroupFrame * const 0x012c1470, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, RowGroupReflowState & {...}, unsigned int & 0, nsTableRowFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 371 + 34 bytes nsTableRowGroupFrame::Reflow(nsTableRowGroupFrame * const 0x012c1474, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 978 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x012c1470, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableFrame::ResizeReflowPass1(nsTableFrame * const 0x012c1b70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0, nsTableRowGroupFrame * 0x00000000, nsReflowReason eReflowReason_Initial, int 1) line 2527 nsTableFrame::Reflow(nsTableFrame * const 0x012c1b74, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 2381 + 43 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x012c1b70, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsTableOuterFrame::Reflow(nsTableOuterFrame * const 0x012c1984, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 943 + 37 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x012c1980, const nsRect & {...}, int 1, nsMargin & {...}, unsigned int & 0) line 155 + 39 bytes nsBaseIBFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x012c4390, int & 1) line 2098 + 45 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x012c4390, int & 1) line 1564 + 20 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1300 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4938 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x012c13e4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 804 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x012c13e4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4571 + 25 bytes nsToolbarFrame::Reflow(nsToolbarFrame * const 0x012c13e4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 128 nsToolboxFrame::Reflow(nsToolboxFrame * const 0x012c1124, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 299 + 31 bytes nsInlineReflow::ReflowFrame(int 0, nsHTMLReflowMetrics & {...}, unsigned int & 0) line 447 nsInlineReflow::ReflowFrame(nsIFrame * 0x012c1120, int 0, unsigned int & 0) line 269 + 20 bytes nsInlineFrame::ReflowInlineFrame(nsInlineFrame::ReflowState & {...}, nsIFrame * 0x012c1120, unsigned int & 0) line 1409 + 18 bytes nsInlineFrame::ReflowInlineFrames(nsInlineFrame::ReflowState & {...}, nsHTMLReflowMetrics & {...}, unsigned int & 0) line 1335 + 23 bytes nsInlineFrame::Reflow(nsInlineFrame * const 0x012c0704, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1246 + 26 bytes nsInlineReflow::ReflowFrame(int 0, nsHTMLReflowMetrics & {...}, unsigned int & 0) line 447 nsInlineReflow::ReflowFrame(nsIFrame * 0x012c0700, int 0, unsigned int & 0) line 269 + 20 bytes nsInlineFrame::ReflowInlineFrame(nsInlineFrame::ReflowState & {...}, nsIFrame * 0x012c0700, unsigned int & 0) line 1409 + 18 bytes nsInlineFrame::ReflowInlineFrames(nsInlineFrame::ReflowState & {...}, nsHTMLReflowMetrics & {...}, unsigned int & 0) line 1335 + 23 bytes nsInlineFrame::Reflow(nsInlineFrame * const 0x012c0bd4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 1246 + 26 bytes nsInlineReflow::ReflowFrame(int 1, nsHTMLReflowMetrics & {...}, unsigned int & 0) line 447 nsInlineReflow::ReflowFrame(nsIFrame * 0x012c0bd0, int 1, unsigned int & 0) line 269 + 20 bytes nsBaseIBFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineBox * 0x012c4890, nsIFrame * 0x012c0bd0, int & 1, int & 1) line 2248 + 31 bytes nsBaseIBFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x012c4890, int & 1) line 1606 + 28 bytes nsBaseIBFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1300 + 26 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 4938 nsBaseIBFrame::Reflow(nsBaseIBFrame * const 0x012c08f4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 804 + 25 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x012c08f4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 4571 + 25 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x012c08f4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 508 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x012c08f0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes RootFrame::Reflow(RootFrame * const 0x012c0584, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 248 nsContainerFrame::ReflowChild(nsIFrame * 0x012c0580, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x01298fb4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 340 nsContainerFrame::ReflowChild(nsIFrame * 0x01298fb0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 363 + 28 bytes ViewportFrame::Reflow(ViewportFrame * const 0x0123e904, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 427 PresShell::InitialReflow(PresShell * const 0x012bdd00, int 7344, int 3576) line 726 nsXMLContentSink::StartLayout() line 1330 nsXMLContentSink::DidBuildModel(nsXMLContentSink * const 0x01275bf0, int 1) line 261 CWellFormedDTD::DidBuildModel(CWellFormedDTD * const 0x0124adb0, unsigned int 0, int 1, nsIParser * 0x01275af0, nsIContentSink * 0x01275bf0) line 300 + 20 bytes nsParser::DidBuildModel(unsigned int 0) line 482 + 55 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 714 nsParser::OnStopBinding(nsParser * const 0x01275af4, nsIURL * 0x012488c0, unsigned int 0, unsigned short * 0x012473b0) line 934 + 17 bytes nsDocumentBindInfo::OnStopBinding(nsDocumentBindInfo * const 0x01248870, nsIURL * 0x012488c0, unsigned int 0, unsigned short * 0x012473b0) line 1734 + 30 bytes OnStopBindingProxyEvent::HandleEvent(OnStopBindingProxyEvent * const 0x01247360) line 594 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x01247364) line 474 + 12 bytes PL_HandleEvent(PLEvent * 0x01247364) line 472 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x011f1520) line 433 + 9 bytes _md_EventReceiverProc(void * 0x0022052e, unsigned int 49340, unsigned int 0, long 18814240) line 784 + 9 bytes USER32! 77e713ed() The pre condition that calls the user breakpoint and crashes the app is in nsTableFrame::GetEffectiveRowSpan(): NS_PRECONDITION (0<=aRowIndex && aRowIndex<GetRowCount(), "bad row index arg");

It no longer crashes. I don't know enough about xul to know if the test case is right. The following simple html example illustrates that <span>s can have a display of table-cell. If the xul is correct, please reopen this bug (or make another) and assign it to rickg, because the content model of the original test case does not look right. <html> <body> <span style="display: table-cell">foo</span> <span style="display: table-cell">bar</span> </body> </html>

I will verify this as fixed in regards to crashing. No guarantees as to the validity of the test case for other purposes.