1333001 - Assertion failure: value, at BindingUtils.h:900

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: stack

Found by bughunter and reproduced on latest windows debug trunk tinderbox build.

Steps to reproduce:
-> Load https://indianstudyhub.com/logical-reasoning/topics/

Crashes instantly opt and debug builds at least on windows

Crash id: https://crash-stats.mozilla.com/report/index/53eda3ae-1f11-4d10-9724-e315e2170123

Comment 1

[Carsten Book [:Tomcat]]

[Tracking Requested - why for this release]:
53 - bughunter opt/debug crash

Smaug, Boris, is this something for you ?

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is totally mine.  In bug 851892 I wrote code that assumes that the mMedia of a css::ImportRule is never null (and convinced myself by code inspection that this was the case).  But clearly this isn't the case, for some reason.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Ensure that ImportRule in fact always has a non-null mMedia

I spent a while trying to write a test (that is, produce a situation in which an
@import rule with no child sheet is being cloned in a crashtest), and have not
succeeded so far....

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8829547 [details] [diff] [review]
Ensure that ImportRule in fact always has a non-null mMedia

Approval Request Comment
[Feature/Bug causing the regression]: Bug 851892
[User impact if declined]: Crashes on some sites
[Is this code covered by automated tests?]: No; couldn't figure out a sane way
   to reproduce in our test harnesses.  :(
[Has the fix been verified in Nightly?]: In my build, yes.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Adds a missing "copy the member while
  cloning" thing.
[String changes made/needed]: None.

Comment 5

[Cameron McCormack (:heycam)]

Comment on attachment 8829547 [details] [diff] [review]
Ensure that ImportRule in fact always has a non-null mMedia

Review of attachment 8829547 [details] [diff] [review]:
-----------------------------------------------------------------

Managed to get a crashtest working using a chrome: URL, like you mention in bug 1326509.

Comment 6

[Cameron McCormack (:heycam)]

Attachment: crashtest

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8829713 [details] [diff] [review]
crashtest

r=me.  Thank you!

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/65a5cc2a2ef6
Ensure that ImportRule in fact always has a non-null mMedia.  r=heycam
https://hg.mozilla.org/integration/mozilla-inbound/rev/63dce15dd3d4
Crashtest. r=bzbarsky

Comment 9

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/65a5cc2a2ef6
https://hg.mozilla.org/mozilla-central/rev/63dce15dd3d4

Comment 10

[Gerry Chang [:gchang]]

Track 53+ as this crash is reproducible on real site.

Comment 11

[Gerry Chang [:gchang]]

Comment on attachment 8829547 [details] [diff] [review]
Ensure that ImportRule in fact always has a non-null mMedia

Fix a crash. Aurora53+.

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/542fb35b78c8
https://hg.mozilla.org/releases/mozilla-aurora/rev/7d40ae3963e7