Version: 3.3 (using KDE 3.3.0, (3.1)) Compiler: gcc version 3.3.4 (Debian 1:3.3.4-12) OS: Linux (i686) release 2.6.8-1-686 As the description says. If I have a form control inside a cell which is inside a <thead/>, Konqueror crashes. Verified with <input/> and <select/> controls. Also happens with <tbody/> and <tfoot/>. Making any of the following changes fixes the crash: * Set thead/body/foot to position: absolute * Set the form control to position: relative * Move the position: relative to the table, tr, or td parents of the form control.

Created an attachment (id=7721) [details] Minimal testcase Minimal testcase; valid XHTML 1.0 Strict.

#5 0x41ca2d97 in khtml::RenderBlock::insertPositionedObject (this=0x0, o=0x870c874) at render_block.cpp:1331 #6 0x41c9bedd in khtml::RenderBlock::layoutInlineChildren (this=0x870c7c0, relayoutChildren=true) at bidi.cpp:1299 #7 0x41c9fc18 in khtml::RenderBlock::layoutBlock (this=0x870c7c0, relayoutChildren=true) at render_block.cpp:522 #8 0x41cd019b in khtml::RenderTableCell::layout (this=0x870c7c0) at render_table.cpp:1822 #9 0x41ccfc97 in khtml::RenderTableRow::layout (this=0x870c798) at render_table.cpp:1740 #10 0x41cf99b8 in khtml::RenderObject::layoutIfNeeded (this=0x870c798) at render_object.h:371 #11 0x41cb5eea in khtml::RenderContainer::layout (this=0x870c6e8) at render_container.cpp:386 #12 0x41ccace2 in khtml::RenderTable::layout (this=0x870c640) at render_table.cpp:274 #13 0x41cf99b8 in khtml::RenderObject::layoutIfNeeded (this=0x870c640) at render_object.h:371 #14 0x41ca0f78 in khtml::RenderBlock::layoutBlockChildren (this=0x870c5c8, relayoutChildren=true) at render_block.cpp:863 #15 0x41c9fc2d in khtml::RenderBlock::layoutBlock (this=0x870c5c8, relayoutChildren=true) at render_block.cpp:524 #16 0x41c9f76f in khtml::RenderBlock::layout (this=0x870c5c8) at render_block.cpp:434 #17 0x41cf99b8 in khtml::RenderObject::layoutIfNeeded (this=0x870c5c8) at render_object.h:371 #18 0x41ca0f78 in khtml::RenderBlock::layoutBlockChildren (this=0x870c54c, relayoutChildren=true) at render_block.cpp:863 #19 0x41c9fc2d in khtml::RenderBlock::layoutBlock (this=0x870c54c, relayoutChildren=true) at render_block.cpp:524 #20 0x41c9f76f in khtml::RenderBlock::layout (this=0x870c54c) at render_block.cpp:434 #21 0x41cee432 in khtml::RenderBody::layout (this=0x870c54c) at render_body.cpp:94 #22 0x41cf99b8 in khtml::RenderObject::layoutIfNeeded (this=0x870c54c) at render_object.h:371 #23 0x41ca0f78 in khtml::RenderBlock::layoutBlockChildren (this=0x870c488, relayoutChildren=true) at render_block.cpp:863 #24 0x41c9fc2d in khtml::RenderBlock::layoutBlock (this=0x870c488, relayoutChildren=true) at render_block.cpp:524 #25 0x41c9f76f in khtml::RenderBlock::layout (this=0x870c488) at render_block.cpp:434 #26 0x41cf99b8 in khtml::RenderObject::layoutIfNeeded (this=0x870c488) at render_object.h:371 #27 0x41ca0f78 in khtml::RenderBlock::layoutBlockChildren (this=0x870c388, relayoutChildren=false) at render_block.cpp:863 #28 0x41c9fc2d in khtml::RenderBlock::layoutBlock (this=0x870c388, relayoutChildren=false) at render_block.cpp:524 #29 0x41c9f76f in khtml::RenderBlock::layout (this=0x870c388) at render_block.cpp:434 #30 0x41ce73a6 in khtml::RenderCanvas::layout (this=0x870c388) at render_canvas.cpp:158 #31 0x41bea1d2 in KHTMLView::layout (this=0x83149a0) at khtmlview.cpp:725 #32 0x41bf281d in KHTMLView::timerEvent (this=0x83149a0, e=0xbffff2c0) at khtmlview.cpp:2719 #33 0x41286253 in QObject::event () from /opt/qt333/lib/libqt-mt.so.3 #34 0x412beb0f in QWidget::event () from /opt/qt333/lib/libqt-mt.so.3 #35 0x4122c0bf in QApplication::internalNotify () from /opt/qt333/lib/libqt-mt.so.3 #36 0x4122b6be in QApplication::notify () from /opt/qt333/lib/libqt-mt.so.3 #37 0x4079bed7 in KApplication::notify (this=0xbffff6a0, receiver=0x83149a0, event=0xbffff2c0) at kapplication.cpp:495 #38 0x4121b8f5 in QEventLoop::activateTimers () from /opt/qt333/lib/libqt-mt.so.3 #39 0x411d4ccb in QEventLoop::processEvents () from /opt/qt333/lib/libqt-mt.so.3 #40 0x4123e478 in QEventLoop::enterLoop () from /opt/qt333/lib/libqt-mt.so.3 #41 0x4123e328 in QEventLoop::exec () from /opt/qt333/lib/libqt-mt.so.3 #42 0x4122c311 in QApplication::exec () from /opt/qt333/lib/libqt-mt.so.3 #43 0x417afc27 in kdemain (argc=2, argv=0x805c8c8) at konq_main.cc:204 #44 0x40961938 in kdeinitmain (argc=2, argv=0x805c8c8) at konqueror_dummy.cc:2 #45 0x0804e2c5 in launch (argc=2, _name=0x80ed13c "konqueror", args=0x80ed14f "\001", cwd=0x0, envc=1, envs=0x80ed160 "", reset_env=false, tty=0x0, avoid_loops=false, startup_id_str=0x80ed164 "baron;1099314022;346927;30341_TIME15083282") at kinit.cpp:599 #46 0x0804f5d8 in handle_launcher_request (sock=8) at kinit.cpp:1163 #47 0x0804fccb in handle_requests (waitForPid=0) at kinit.cpp:1364 #48 0x08051335 in main (argc=3, argv=0xbffffd24, envp=0xbffffd34) at kinit.cpp:1817

CVS commit by ggarand: ignore relative positioning on table sections. CSS 2.1 does not define that, but it is a consensus amongst all major browsers. BUG: 90437 M +6 -0 ChangeLog 1.323 M +3 -2 css/cssstyleselector.cpp 1.324 --- kdelibs/khtml/ChangeLog #1.322:1.323 @@ -1,2 +1,8 @@ +2004-11-02 Germain Garand <germain@ebooksfrance.com> + + * css/cssstyleselector.cpp (adjustRenderStyle): + ignore relative positioning on table sections. CSS 2.1 does not + define that, but it is a consensus amongst all major browsers. + 2004-11-01 Sandro Giessl <sandro@giessl.com> --- kdelibs/khtml/css/cssstyleselector.cpp #1.323:1.324 @@ -588,5 +588,6 @@ void CSSStyleSelector::adjustRenderStyle // table rows. This has been established in CSS2.1 (and caused a crash in containingBlock() on // some sites). - if (style->display() == TABLE_ROW && style->position() == RELATIVE) + // Likewise, disallow relative positioning on table sections. + if ( style->position() == RELATIVE && (style->display() > INLINE_TABLE && style->display() < TABLE_COLUMN_GROUP) ) style->setPosition(STATIC); }