308766 - Invalid read in CSSLoaderImpl::LoadChildSheet

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Andrew Schultz]

During startup (before any window is shown) with SeaMonkey trunk CVS pulled this
morning, I get the following when running under valgrind

Invalid read of size 1
 CSSLoaderImpl::LoadChildSheet(nsICSSStyleSheet*, nsIURI*, nsMediaList*,
nsICSSImportRule*) (nsCSSLoader.cpp:1839)
 CSSParserImpl::ProcessImport(unsigned&, nsString const&, nsMediaList*, void
(*)(nsICSSRule*, void*), void*) (nsCSSParser.cpp:1365)
 CSSParserImpl::ParseImportRule(unsigned&, void (*)(nsICSSRule*, void*), void*)
(nsCSSParser.cpp:1336)
 CSSParserImpl::ParseAtRule(unsigned&, void (*)(nsICSSRule*, void*), void*)
(nsCSSParser.cpp:1177)
 CSSParserImpl::Parse(nsIUnicharInputStream*, nsIURI*, nsIURI*, unsigned,
nsICSSStyleSheet*&) (nsCSSParser.cpp:697)
 CSSLoaderImpl::ParseSheet(nsIUnicharInputStream*, SheetLoadData*, int&)
(nsCSSLoader.cpp:1421)
 CSSLoaderImpl::LoadSheet(SheetLoadData*, StyleSheetState) (nsCSSLoader.cpp:1272)
 CSSLoaderImpl::InternalLoadNonDocumentSheet(nsIURI*, nsICSSStyleSheet**,
nsICSSLoaderObserver*) (nsCSSLoader.cpp:1908)
 CSSLoaderImpl::LoadSheetSync(nsIURI*, nsICSSStyleSheet**) (nsCSSLoader.cpp:1847)
 nsContentDLF::EnsureUAStyleSheet() (nsContentDLF.cpp:645)
 nsContentDLF::CreateInstanceForDocument(nsISupports*, nsIDocument*, char
const*, nsIContentViewer**) (nsContentDLF.cpp:305)
 nsDocShell::CreateAboutBlankContentViewer() (nsDocShell.cpp:4799)
Address 0x3472E71C is 116 bytes inside a block of size 128 free'd
 operator delete(void*) (vg_replace_malloc.c:155)
 SheetLoadData::~SheetLoadData() (nsCSSLoader.cpp:239)
 SheetLoadData::Release() (nsCSSLoader.cpp:141)
 CSSLoaderImpl::SheetComplete(SheetLoadData*, unsigned) (nsCSSLoader.cpp:1551)
 CSSLoaderImpl::ParseSheet(nsIUnicharInputStream*, SheetLoadData*, int&)
(nsCSSLoader.cpp:1431)
 CSSLoaderImpl::LoadSheet(SheetLoadData*, StyleSheetState) (nsCSSLoader.cpp:1272)
 CSSLoaderImpl::LoadChildSheet(nsICSSStyleSheet*, nsIURI*, nsMediaList*,
nsICSSImportRule*) (nsCSSLoader.cpp:1836)
 CSSParserImpl::ProcessImport(unsigned&, nsString const&, nsMediaList*, void
(*)(nsICSSRule*, void*), void*) (nsCSSParser.cpp:1365)
 CSSParserImpl::ParseImportRule(unsigned&, void (*)(nsICSSRule*, void*), void*)
(nsCSSParser.cpp:1336)
 CSSParserImpl::ParseAtRule(unsigned&, void (*)(nsICSSRule*, void*), void*)
(nsCSSParser.cpp:1177)
 CSSParserImpl::Parse(nsIUnicharInputStream*, nsIURI*, nsIURI*, unsigned,
nsICSSStyleSheet*&) (nsCSSParser.cpp:697)
 CSSLoaderImpl::ParseSheet(nsIUnicharInputStream*, SheetLoadData*, int&)
(nsCSSLoader.cpp:1421)

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

bz and jst both have patches on the bug that caused this, I think.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Fixed by the patch I just checked in (which is attached to bug 293825).