Closed Bug 310006 Opened 19 years ago Closed 19 years ago

Recalculating quote and counter lists can reenter itself

Categories

(Core :: Layout, defect, P2)

x86
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla1.8beta5

People

(Reporter: bzbarsky, Assigned: bzbarsky)

Details

(Keywords: fixed1.8)

Attachments

(2 files)

If during RecalcAll() on the quote list or counter manager we find that a quote
or counter has changed, we use SetData() to change the text.  This calls
BeginUpdate() and EndUpdate(), and since we're already decremented mUpdateCount
in the frame constructor we end up reentering the relevant RecalcAll() method. 
The result is that we'll walk along the list effectively N times, where N is the
number of dirty nodes.
Attached file Testcase
This gave me the following stack:

#0  nsQuoteList::RecalcAll (this=0xb3e14260)
    at ../../../mozilla/layout/base/nsQuoteList.cpp:84
#1  0xb5ed1ac7 in nsCSSFrameConstructor::EndUpdate (this=0xb3e14240)
    at ../../../mozilla/layout/base/nsCSSFrameConstructor.cpp:10595
#2  0xb5f247be in PresShell::EndUpdate (this=0xb3e13e28, aDocument=0xb3e09e30, 

    aUpdateType=1) at ../../../mozilla/layout/base/nsPresShell.cpp:3431
#3  0xb616f7ab in nsDocument::EndUpdate (this=0xb3e09e30, aUpdateType=1)
    at ../../../../mozilla/content/base/src/nsDocument.cpp:2116
#4  0xb5f80fa1 in mozAutoDocUpdate::~mozAutoDocUpdate ()
    at ../../../../dist/include/xpcom/nsIClassInfo.h:35
#5  0xb61931c9 in nsGenericDOMDataNode::SetText (this=0xb3e115d8,
aStr=@0xb3e29cfc, 
    aNotify=1) at
../../../../mozilla/content/base/src/nsGenericDOMDataNode.cpp:1225
#6  0xb61914b2 in nsGenericDOMDataNode::SetData (this=0xb3e115d8,
aData=@0xb3e29cfc)
    at ../../../../mozilla/content/base/src/nsGenericDOMDataNode.cpp:366
#7  0xb61d3511 in nsTextNode::SetData (this=0xb3e115d8, aData=@0xb3e29cfc)
    at ../../../../mozilla/content/base/src/nsTextNode.cpp:65
#8  0xb5f39999 in nsQuoteList::RecalcAll (this=0xb3e14260)
    at ../../../mozilla/layout/base/nsQuoteList.cpp:93
Attachment #197377 - Flags: superreview?(dbaron)
Attachment #197377 - Flags: review?(dbaron)
Attachment #197377 - Flags: superreview?(dbaron)
Attachment #197377 - Flags: superreview+
Attachment #197377 - Flags: review?(dbaron)
Attachment #197377 - Flags: review+
Comment on attachment 197377 [details] [diff] [review]
Perhaps something like this?

Requesting 1.8b5 approval.  This is a very safe change; I'll be landing it on
trunk tomorrow.
Attachment #197377 - Flags: approval1.8b5?
Fixed on trunk.
Status: NEW → RESOLVED
Closed: 19 years ago
Priority: -- → P2
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.8beta5
Comment on attachment 197377 [details] [diff] [review]
Perhaps something like this?

Approved per 9/26 bug triage meeting.
Attachment #197377 - Flags: approval1.8b5? → approval1.8b5+
Flags: blocking1.8b5+
Fixed on branch.
Keywords: fixed1.8
Product: Core → Core Graveyard
Component: Layout: Misc Code → Layout
Product: Core Graveyard → Core
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: