170699 - [CRASH] CSSRule.parentRule crashes on a style rule inserted in a media rule

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P2)

Description

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

The attached URL crashes Mozilla (tested Win2k and RH72).

It inserts a new style rule in an existing media rule and then queries for the
parent rule of the style rule.

Expected result : the media rule
Actual result   : crack boom core dump

(Nota bene : this blocks CaScadeS)

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

I chose this fix rather than changing SetParentRuleReference because I'm
worried that some compilers might do an adjustment on the null by mistake.  (I
recall CodeWarrior doing it when constant-folding -- someone wrote a null-based
table-driven QI that worked on CodeWarrior, but I'm not sure if it would do the
same thing at runtime.)

Comment 2

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

Comment on attachment 100543 [details] [diff] [review]
patch

r=glazman

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 100543 [details] [diff] [review]
patch

sr=roc+moz

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to trunk, 2002-10-02 18:02 PDT.

Comment 5

[Madhur Bhatia]

checked the testcase mentioned in the url on 
win2000 -------- 2002-10-03-08trunk
RH linux7.2 ---- 2002-10-03-08trunk

there is no crash. Marking verified.

Comment 6

[Madhur Bhatia]

--> nsbeta1

Comment 7

[Madhur Bhatia]

The testcase is still crashing the win2k branch build. I checked on the
2002-10-28-12-1.0 branch build on win2000. 

The trunk build looks good. What are the plans for this patch to be checked in
branch ??? 

Comment 8

[Boris Zbarsky [:bzbarsky]]

It's simple enough that we might as well... I've requested driver approval.

Comment 9

[Madhur Bhatia]

that would be great .

Thanks Boris!!

Comment 10

[Daniel Veditz [:dveditz]]

adt would take this on the branch if drivers approve. Please add the fixed1.0.2
keyword if it gets checked in.

Comment 11

[Michael Buckland]

removing adt markings, please renominate if you get drivers approval.