Closed Bug 317854 Opened 19 years ago Closed 19 years ago

Crash in [@ 0x00cd0003 DeletingFrameSubtree] with evil testcase using display:table-cell and a lot of position:absolute

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: martijn.martijn, Assigned: MatsPalmgren_bugz)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

testcase
(deleted), text/html
Details 
See upcoming testcase.
Mozilla crashes when hovering over the text.
Doesn't happen in Mozilla1.7.

Talkback ID: TB12271402Q

0x00cd0003
DeletingFrameSubtree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9732]
nsCSSFrameConstructor::ContentRemoved  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9883]
nsCSSFrameConstructor::RecreateFramesForContent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 11495]
nsCSSFrameConstructor::RestyleElement  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10377]
nsCSSFrameConstructor::ProcessOneRestyle  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13211]
nsCSSFrameConstructor::ProcessPendingRestyles  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13259]
nsCSSFrameConstructor::RestyleEvent::HandleEvent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 13324]
SHELL32.dll + 0x520c24 (0x778b0c24)
Attached file testcase (deleted) — 

    
    

    
  
Does the patch in bug 310638 help here?  It seems like it should...
Depends on: 310638
Summary: Crash with evil testcase using display:table-cell and a lot of position:absolute → Crash in [@ 0x00cd0003 DeletingFrameSubtree] with evil testcase using display:table-cell and a lot of position:absolute

    
    

    
  
Crashes 1.5rc3 on OS/2
OS: Windows XP → All

    
  
Blocks: ajax-demolisher

    
    

    
  
Yes, the patch in bug 310638 fixes the crash.

    
    

    
  
I can repro in today's nightly build, but not in a later hourly build from atlantia (with the patch for bug 310638).  -> FIXED.
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED

    
  
Status: RESOLVED → REOPENED
Resolution: FIXED → ---

    
  
Assignee: nobody → mats.palmgren
Status: REOPENED → NEW

    
  
Status: NEW → RESOLVED
Closed: 19 years ago → 19 years ago
Resolution: --- → FIXED

    
    

    
  
Verified FIXED using builds:

SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060127 Mozilla/1.0 and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060127 Firefox/1.6a1

on the testcase URL: https://bugzilla.mozilla.org/attachment.cgi?id=204215

no crash.


Status: RESOLVED → VERIFIED
Crash Signature: [@ 0x00cd0003 DeletingFrameSubtree]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: