Created by Jukka Santala (donwulff@iki.fi) on Tuesday, April 7, 1998 5:08:08 AM PDT Additional Details : Sometimes when the ROWSPAN attribute in a table has been set past the number of rows in a table, Composer will end up with memory corruption. This is due to a function using the number of rows to initialize an array. In particular, the following HTML code will demonstrate: <TABLE BORDER=0 CELLPADDING=0 CELLSPACING=0 WIDTH="100%"> <TR><TD BGCOLOR="#000000" VALIGN=TOP ROWSPAN=2> <IMG SRC="images/mozilla-banner.jpg" ALT="" BORDER=0 USEMAP="#banner" WIDTH=600 HEIGHT=50 VSPACE=0 HSPACE=0> </TD></TR></TABLE> From a netscape rep. suggested to use a re-sizable array. From personal view over the code, it seems that the extra array positions arne''t actually needed since the spanned rows don''t get visible, though, so ending the loop once the existing rows have been processed is another possibility. It''s also within possibility that the row counter method needs fixing; need to dig deeper into the code. The following patch solved the problem for debugging: diff --unified --recursive mozorg/ns/lib/layout/edtbuf.cpp mozilla/ns/lib/layout/edtbuf.cpp --- mozorg/ns/lib/layout/edtbuf.cpp Mon Mar 30 17:55:37 1998 +++ mozilla/ns/lib/layout/edtbuf.cpp Sat Apr 04 21:35:37 1998 @@ -1860,8 +1860,11 @@ // then it will cause extra columns in following row(s) if( iRowSpan > 1 ) { - for( intn j = 1; j < iRowSpan; j++ ) - ExtraColumns[iRow+j] += iColSpan; + for( intn j = 1; j < iRowSpan; j++ ) { + if((iRow+j)>=iRows) XP_TRACE(("CEditBuffer::FixupTableData() inconsistency!")); + else ExtraColumns[iRow+j] += iColSpan; + XP_TRACE(("Did stuff")); + } } // Save actual location and size data EDT_TableCellData *pCellData = pEdCell->GetData(); This patch is incomplete, as it doesn''t deal with the side-effects of the loop which may do other nasty stuff, however it''s useful in debugging the problem for me. Updated by (brade@netscape.com) on Thursday, April 16, 1998 8:52:10 PM PDT Additional Details : Reassign bug to myself since I'm the owner of this file. I'm guessing that this is really cross-platform (ALL) but I haven't tested it on any platform to confirm yet.

Greg, please have someone verify this -- thanks

eli set as qa contact, eli can you verify this asap?

Verify against what? We don't have a composer 5.0 right now.

old code base -- marking as verified

setting to an approximate milestone so it can be off of the no TFV list