The referenced table uses thead/tbody/tfoot to group rows -- however, some of the cells in these rows span outside the defined thead/tbody/tfoot groupings. The result is that Raptor crashes and burns (page fault in gkhtml.dll) Obviously the renderer shouldn't crash ;-). On the other hand, it is unclear to me how the table layout engine _should_ render tables such as this (admittedly pathological) example, where the row grouping elements group rows containing cells that span outside the groups. This was tested in the 19/Nov/99 nightly build.

Added two additional cases to test this bug: A) http://smaug.java.utoronto.ca/~igraham/NS5-bugs/table-bug2.html -- raptor crashes B) http://smaug.java.utoronto.ca/~igraham/NS5-bugs/table-bug3.html -- raptor does not crash The only difference in (A)relative to (B) is that a single cell in (A) spans from the last cell of the tbody row group into the tfoot row group.

I have a page where I make some commentary on the issue of interaction between grouping and spanning of rows and columns, particularly how it relates in my readings of HTML 4.0 and HTML 4.01. http://www.war-of-the-worlds.org/html/group-vs-span.html It includes a table where the content is extending beyond the bounds of cells where spanning is prevented in the build. (I'm using Mac M11 build.) The trouble arises because the specification says TFOOT must come before TBODY though its final rendering position is after TBODY, plus the issue whether to reserve or not reserve space for a cell due to its aborted spanning. Should groups be treated like table components and have spanning extend the number of rows/columns within them? Untested thus far are the equivalent cases of COLGROUPs.

Please note that the two table-bug.html pages use invalid HTML. TFOOT must come before any TBODY in the markup Also, table-bug2.html doesn't crash Macintosh M11 build.

On my Win98 1999122208 build it doesn't crash

Fixed with latest checkin.

Using 1/13 build, verified fixed. No crashes.