Closed Bug 1205486 Opened 4 years ago Closed 4 years ago

Marionette crash under ~nsStyleContext due to CSSVariableImageTable manipulation

Categories

(Core :: CSS Parsing and Computation, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla43
Tracking Status
firefox43 --- fixed

People

(Reporter: heycam, Assigned: heycam)

References

Details

Attachments

(1 file)

Dry runs of the upcoming central -> aurora merge result in crashes in Marionette:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e8cdb09267b6

Seth diagnosed this to be probably due to re-entrant manipulation of the CSSVariableImageTable (as releasing objects in that table cause other style contexts to be released and thus removed from the same table).
Blocks: 1181907
Something that compiles and doesn't assert: https://treeherder.mozilla.org/#/jobs?repo=try&revision=5de9868f74ec
Attached patch patchSplinter Review
Assignee: nobody → cam
Status: NEW → ASSIGNED
Attachment #8662235 - Flags: review?(seth)
Comment on attachment 8662235 [details] [diff] [review]
patch

Review of attachment 8662235 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good! Thanks for getting this fixed, Cameron.
Attachment #8662235 - Flags: review?(seth) → review+
https://hg.mozilla.org/mozilla-central/rev/db852503a55f
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
You need to log in before you can comment on or make changes to this bug.