Subtract the row index from the row count, not the col count. b=284852 r=bernd sr=bzbarsky
authorMats Palmgren <mats.palmgren@bredband.net>
Sun, 19 Oct 2008 10:25:14 +0200
changeset 20628 641db8b29158e96ff80df083dd5585b3611d5d07
parent 20627 f941129cae018854f6b39f8b2bb65a8ebf419216
child 20629 28fc43e4394c25ce34ef7f87051a4f843061d249
push idunknown
push userunknown
push dateunknown
reviewersbernd, bzbarsky
bugs284852
milestone1.9.1b2pre
Subtract the row index from the row count, not the col count. b=284852 r=bernd sr=bzbarsky
layout/tables/crashtests/284852.html
layout/tables/crashtests/crashtests.list
layout/tables/nsCellMap.cpp
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/284852.html
@@ -0,0 +1,130 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 284852</title>
+    <style type="text/css">
+
+        table {
+	   border-collapse: collapse;
+           border:3px dashed blue;
+        }
+	td {
+	  border:3px dotted black;
+        }
+    </style>
+<script>
+  function insertCell(id,rowspan) {
+    var tr = document.getElementById(id);
+    var td = document.createElement('td');
+    td.setAttribute('rowspan',rowspan);
+    tr.insertBefore(td,tr.firstChild)
+  }
+</script>
+</head>
+<body>
+
+<table>
+<tbody>
+  <tr><td>g1row1</td></tr>
+  <tr><td>g1row2</td></tr>
+  <tr><td>g1row3</td></tr>
+</tbody>
+<tbody>
+  <tr><td>g2row1</td></tr>
+  <tr><td>g2row2</td></tr>
+  <tr><td>g2row3</td></tr>
+  <tr id="r1"><td rowspan="0">g2row4</td></tr>
+</tbody>
+</table>
+
+<script>
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+insertCell('r1','0');
+</script>
+
+<button onclick="insertCell('r1','0')">insert cell</button>
+<pre>
+Clicking the button above five times or more gives:
+
+###!!! ASSERTION: invalid BC damage area: 'PR_FALSE', file nsTableFrame.cpp, line 4567
+</pre>
+
+<table>
+<tbody>
+  <tr><td>g1row1</td></tr>
+  <tr><td>g1row2</td></tr>
+  <tr><td>g1row3</td></tr>
+</tbody>
+<tbody>
+  <tr><td>g2row1</td></tr>
+  <tr><td>g2row2</td></tr>
+  <tr><td>g2row3</td></tr>
+  <tr id="r2"><td rowspan="2">g2row4</td></tr>
+</tbody>
+</table>
+
+<script>
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+insertCell('r2','2');
+</script>
+<button onclick="insertCell('r2','2')">insert cell</button>
+<pre>
+Clicking the button gives:
+
+###!!! ASSERTION: invalid BC damage area: 'PR_FALSE', file nsTableFrame.cpp, line 4567
+</pre>
+
+<table>
+<tbody>
+  <tr><td>g1row1</td></tr>
+  <tr><td>g1row2</td></tr>
+  <tr><td>g1row3</td></tr>
+</tbody>
+<tbody>
+  <tr><td>g2row1</td></tr>
+  <tr><td>g2row2</td></tr>
+  <tr><td>g2row3</td></tr>
+  <tr id="r3"></tr>
+</tbody>
+</table>
+
+<script>
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+insertCell('r3','0');
+</script>
+
+<button onclick="insertCell('r3','0')">insert cell</button>
+<pre>
+Clicking the button the first time gives:
+
+###!!! ASSERTION: invalid BC damage area: 'PR_FALSE', file nsTableFrame.cpp, line 4567
+</pre>
+
+
+
+</body>
+</html>
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -1,10 +1,11 @@
 load 55789-1.html
 load 284844-1.html
+load 284852.html
 load 300912.html
 load 322779-1.xul
 load 323489-1.html
 load 331344-1.html
 load 331446-1.xhtml
 load 331690-1.html
 load 339315-1.html
 load 341227-1.xhtml
--- a/layout/tables/nsCellMap.cpp
+++ b/layout/tables/nsCellMap.cpp
@@ -1970,17 +1970,17 @@ void nsCellMap::ExpandWithCells(nsTableC
             }
           }
         }
         SetDataAt(aMap, *data, rowX, colX);
       }
     }
     cellFrame->SetColIndex(startColIndex);
   }
-  PRInt32 damageHeight = (aRowSpanIsZero) ? aMap.GetColCount() - aRowIndex : aRowSpan;
+  PRInt32 damageHeight = PR_MIN(GetRowGroup()->GetRowCount() - aRowIndex, aRowSpan);
   SetDamageArea(aColIndex, aRowIndex, 1 + endColIndex - aColIndex, damageHeight, aDamageArea); 
 
   PRInt32 rowX;
 
   // update the row and col info due to shifting
   for (rowX = aRowIndex; rowX <= endRowIndex; rowX++) {
     CellDataArray& row = mRows[rowX];
     PRUint32 numCols = row.Length();