Closed
Bug 370692
Opened 18 years ago
Closed 18 years ago
[FIX]Crash [@ nsCellMapColumnIterator::GetNextFrame] with MathML mtr, rowspan
Categories
(Core :: Layout: Tables, defect)
Core
Layout: Tables
Tracking
()
RESOLVED
FIXED
mozilla1.9alpha3
People
(Reporter: jruderman, Assigned: bzbarsky)
References
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(4 files)
|
(deleted),
application/xhtml+xml
|
Details | |
|
(deleted),
application/xhtml+xml
|
Details | |
|
(deleted),
patch
|
Details | Diff | Splinter Review | |
|
(deleted),
patch
|
rbs
:
review+
rbs
:
superreview+
|
Details | Diff | Splinter Review |
Loading the testcase triggers:
* ###!!! ASSERTION: Bogus mOrigCells?: 'mCurMapRow < mCurMapRelevantRowCount', file /Users/jruderman/trunk/mozilla/layout/tables/nsCellMap.cpp, line 2792
* Crash [@ nsCellMapColumnIterator::GetNextFrame]
This happens both with and without the patch in bug 370586 comment 5.
> This happens both with and without the patch in bug 370586 comment 5.
but the issue looks very similiar, rowspan inherited down to the mtd, which reports 10 when asked for its content rowspan
|
Assignee | |
Comment 2•18 years ago
|
||
|
|
Assignee | |
Comment 3•18 years ago
|
||
Bernd is right -- this is just like bug 370586, but in copy/pasted and slightly different code.
|
|
Assignee | |
Comment 4•18 years ago
|
||
I'd love to write a reftest for the colspan too, but I can't get it to misbehave... ;)
|
|
Assignee | |
Comment 5•18 years ago
|
||
Attachment #255643 -
Flags: superreview?(rbs)
Attachment #255643 -
Flags: review?(rbs)
|
|
Assignee | |
Updated•18 years ago
|
Assignee: nobody → bzbarsky
OS: Mac OS X → All
Hardware: PC → All
Summary: Crash [@ nsCellMapColumnIterator::GetNextFrame] with MathML mtr, rowspan → [FIX]Crash [@ nsCellMapColumnIterator::GetNextFrame] with MathML mtr, rowspan
Target Milestone: --- → mozilla1.9alpha3
Comment on attachment 255643 [details] [diff] [review]
Same as diff -w
r+sr=rbs
Attachment #255643 -
Flags: superreview?(rbs)
Attachment #255643 -
Flags: review?(rbs)
Attachment #255643 -
Flags: review+
Attachment #255643 -
Flags: superreview+
|
|
Assignee | |
Comment 7•18 years ago
|
||
Fixed.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
|
||
Comment 8•18 years ago
|
||
http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&subdir=mozilla/layout/reftests&command=DIFF_FRAMESET&file=reftest.list&rev1=1.54&rev2=1.55&root=/cvsroot
If someone can write the test mentioned in comment 4, that'd be nice too, but this covers most of the functionality, from what I can tell -- open a separate bug for it.
Flags: in-testsuite+
|
||
Updated•13 years ago
|
Crash Signature: [@ nsCellMapColumnIterator::GetNextFrame]
You need to log in
before you can comment on or make changes to this bug.
Description
•