269791 - crash with an extension [@nsIFrame::GetStyleContext]

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

I installed AdBlockLearner 0.8.1 (see bug 269750), and began experiencing
crashes while surfing.  Extensions, no matter how poorly written, should not
crash us.

To reproduce:
1. Install AdBlockLearner 0.8.1
2. Read some stories on cnn.com
3. Block an ad
4. Attempt to read more stories

Comment 1

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: stack

this=0x00000000

in nsFrameManager::ReResolveStyleContext
 aFrame=0x00000000
up again in nsFrameManager::ReResolveStyleContext
 outOfFlowFrame=0x00000000

I didn't see any obvious nulls at higher points in the stack.

Comment 2

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Two asserts that were in the console:
###!!! ASSERTION: no out-of-flow frame: 'outOfFlowFrame', file
d:/aviary/mozilla/layout/html/base/src/nsFrameManager.cpp, line 1597
###!!! ASSERTION: out-of-flow frame not a true descendant: 'outOfFlowFrame !=
resolvedChild', file d:/aviary/mozilla/layout/html/base/src/nsFrameManager.cpp, li
ne 1599

Comment 3

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

After the aviary landing on trunk, I can no longer reproduce the crash.