528134 - inDOMUtils::GetRuleNodeForContent can hand back a dead rulenode

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Boris Zbarsky [:bzbarsky]]

See bug 527567 comment 5.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Zack, do you prefer r=zwol, or r=zweinberg, or something else?

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

A bunch of tabs snuck in to that patch (making the lines look misindented).

Comment 3

[Boris Zbarsky [:bzbarsky]]

Good catch.  Fixed locally.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 411888 [details] [diff] [review]
Fix

r=dbaron

We should really get this in on 1.9.2...

Comment 5

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/mozilla-central/rev/d5a6793282b0

Comment 6

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/2707b779b74a

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: 1.9.1/1.9.0 merge

Applies on 1.9.0 with -F3.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 414451 [details] [diff] [review]
1.9.1/1.9.0 merge

r=dbaron

Comment 9

[Samuel Sidler (old account; do not CC)]

These bugs landed after b4 was cut. Moving flag out.

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 414451 [details] [diff] [review]
1.9.1/1.9.0 merge

Approved for 1.9.1.7 and 1.9.0.17, a=dveditz for release-drivers

Comment 13

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/releases/mozilla-1.9.1/rev/35d5359743c3

Checked into CVS:

Checking in layout/inspector/src/inDOMUtils.cpp;
/cvsroot/mozilla/layout/inspector/src/inDOMUtils.cpp,v  <--  inDOMUtils.cpp
new revision: 1.42; previous revision: 1.41
done
Checking in layout/inspector/src/inDOMUtils.h;
/cvsroot/mozilla/layout/inspector/src/inDOMUtils.h,v  <--  inDOMUtils.h
new revision: 1.13; previous revision: 1.12
done
Checking in layout/style/nsIInspectorCSSUtils.h;
/cvsroot/mozilla/layout/style/nsIInspectorCSSUtils.h,v  <--  nsIInspectorCSSUtils.h
new revision: 1.12; previous revision: 1.11
done
Checking in layout/style/nsInspectorCSSUtils.cpp;
/cvsroot/mozilla/layout/style/nsInspectorCSSUtils.cpp,v  <--  nsInspectorCSSUtils.cpp
new revision: 1.37; previous revision: 1.36
done
Checking in layout/style/nsInspectorCSSUtils.h;
/cvsroot/mozilla/layout/style/nsInspectorCSSUtils.h,v  <--  nsInspectorCSSUtils.h
new revision: 1.13; previous revision: 1.12

Comment 14

[Martin Stránský [:stransky] (ni? me)]

Attachment: 1.8.0 version

Comment 15

[Henrik Skupin [:whimboo][⌚️UTC+1]]

David or Boris, how can QA verify this fix? For the given signature in the summary no crashes are listed at all. For which signature I would have to search?

Comment 16

[Boris Zbarsky [:bzbarsky]]

See bug 527567.

Comment 17

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to comment #16)
> See bug 527567.

I'm not able to reproduce the crash with an 3.5.7 build and the Google Page Speed addon installed. Looks like we have to wait for the beta cycle or the release to check the crash stats.

Comment 18

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

It should be hard to reproduce without frame poisoning.