862185 - Use-after-poison with -moz-column, fieldset

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: this type of frame can't have overflow containers: '(aProperty != nsContainerFrame::OverflowContainersProperty() && aProperty != nsContainerFrame::ExcessOverflowContainersProperty()) || IsFrameOfType(nsIFrame::eCanContainOverflowContainers)', file /Users/jruderman/trees/mozilla-central/layout/generic/nsContainerFrame.cpp, line 1458

Crash with nsFieldSetFrame::GetIntrinsicWidth calling nsLayoutUtils::IntrinsicForContainer.

Nightly: bp-9f41ac48-8362-4f07-84aa-837992130416

Comment 1

[Jesse Ruderman]

Attachment: stack (gdb)

Comment 2

[Mats Palmgren (inactive)]

Attachment: stack for destroying the frame

When we reflow a nsFieldSetFrame and its child frames are COMPLETE
their next-in-flows will be destroyed, by DeleteNextInFlowChild.
The problem is nsFieldSetFrame has frame pointer members mLegendFrame
and mContentFrame that isn't updated when such children are destroyed,
so when we reflow the nsFieldSetFrame's next-in-flow it will use
stale pointers.

Comment 3

[Mats Palmgren (inactive)]

Attachment: Make nsFieldSetFrame reflow overflow container children.

Comment 4

[Mats Palmgren (inactive)]

Attachment: Make nsFieldSetFrame reflow and paint overflow container children.

Comment 5

[Mats Palmgren (inactive)]

Attachment: Remove child frame members which may become stale and add accessors to get them from the child list instead.

https://tbpl.mozilla.org/?tree=Try&rev=ddd01ee1e9f2

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 738216 [details] [diff] [review]
Make nsFieldSetFrame reflow and paint overflow container children.

Review of attachment 738216 [details] [diff] [review]:
-----------------------------------------------------------------

I think we need a reftest here

Comment 7

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/440634eef3f1
https://hg.mozilla.org/integration/mozilla-inbound/rev/b064ea1f6af7

Will add a reftest when the bug is public.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/440634eef3f1
https://hg.mozilla.org/mozilla-central/rev/b064ea1f6af7

Comment 9

[Daniel Veditz [:dveditz]]

The ESR 17.0.5 version of this crash is also frame poisoning (as expected): bp-e40441a7-ca1c-4ba3-ad77-2f5032130503

Comment 11

[Mats Palmgren (inactive)]

Landed a crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0246c21cfc5c

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0246c21cfc5c