1209896 - "ASSERTION: Cannot find containing block" followed by null deref in InlineBackgroundData::GetContinuousRect

Status: NEW

(Core :: Layout, defect)

Description

[SkyLined]

Attachment: repro.html

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Build ID: 20150826023504

Steps to reproduce:

<rt dir=rtl><x style=background:red>x<svg display=table-column>


Actual results:

Access violation while reading memory at 0x18 using a NULL ptr

Stack
xul.dll!InlineBackgroundData::GetContinuousRect + 0x23 (EF in id)
xul.dll!InlineBackgroundData::GetBorderContinuousRect + 0x2A (D8 in id)
xul.dll!JoinBoxesForSlice + 0x3A
xul.dll!BoxDecorationRectForBorder + 0x2ACFA7 (this may not be correct)
xul.dll!mozilla::gfx::DrawTargetCairo::SetTransform + 0x8A
xul.dll!nsCSSRendering::PaintBorder + 0xA8
xul.dll!nsDisplayBorder::Paint + 0x57



Expected results:

Page loads without crashing Firefox

Comment 1

[Gingerbread Man]

Please do the following:

1. Update to the current release.
https://support.mozilla.org/kb/update-firefox-latest-version
2. Reproduce the crash, submit the crash report, then restart Firefox.
3. Type about:crashes into the location bar, then press Enter.
4. Copy the most recent report ID to the clipboard, then paste it in a comment here.

Comment 2

[SkyLined]

Is the repro failing for you that I need to do all this for you? Btw. it crashes up-to-date Nightly.

Comment 3

[Jesse Ruderman]

Attachment: stack (lldb)

###!!! ASSERTION: Cannot find containing block.: 'mBlockFrame', file layout/base/nsCSSRendering.cpp, line 338

Followed by InlineBackgroundData::GetContinuousRect dereferencing a null mBlockFrame.

Comment 4

[Jesse Ruderman]

bp-b6276d68-8c0f-4c88-97d7-14e8b2151005

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.