245572 - Crash displaying www.thewebtier.com/template.jsp?selected=4 [@ nsCSSValue::Reset ]

Status: RESOLVED FIXED

(Core :: DOM: CSS Object Model, defect)

Description

[Ronald Tilby]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a2) Gecko/20040603
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a2) Gecko/20040603

Linked to URL from google search results.
Page displayed, then Mozilla crashed.
Talkback IDs: TB74569Q, TB74559W using Mozilla nightly 2004060208
Talkback ID: TB74619Y using Mozilla nightly 2004060308

Reproducible: Always
Steps to Reproduce:
1.load http://www.thewebtier.com/template.jsp?selected=4
2.wait a few seconds
3.crash

Actual Results:  
crash

Expected Results:  
not crash

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

Confirming with build 2004-06-04-07, Windows XP.

Comment 2

[Olivier Cahagne]

Attachment: Stacktrace Mozilla debug build 20040516

apologies for my broken Linux box (GDB returns some variable not being
available), hope this is useful anyway:

(gdb) frame 2
#2  0x4137a3bc in nsCSSDeclaration::RemoveProperty(nsCSSProperty)
(this=Variable "this" is not available.
)
    at nsCSSDeclaration.cpp:139
139	    data.ClearProperty(aProperty);
(gdb) p aProperty
$2 = eCSSProperty_UNKNOWN

Comment 3

[Hermann Schwab]

TB74783H
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a2) Gecko/20040603

Error message from Opera´s Javascript console:

Event thread: onload
Error:
name: TypeError
message: Statement on line 180: Expression evaluated to null or undefined and is
not convertible to Object: iframeSourceDocument.body
Backtrace:
  Line 180 of linked script http://www.thewebtier.com/tooltip.js
    children = iframeSourceDocument.body.childNodes;
  Line 215 of linked script http://www.thewebtier.com/tooltip.js
    var numbertooltips = findNumberOfTooltips();
  In unknown script
    parent.addContent();
  At unknown location
 

Comment 4

[Rene Pronk]

I think I know what is going on here. In Javascript the CSS property
CounterIncrement is set which according is defined as

CSS_PROP_NOTIMPLEMENTED(counter-increment, counter_increment, CounterIncrement)

Because Mozilla hasn't implemented this, this results in

nsresult nsCSSDeclaration::RemoveProperty(nsCSSProperty aProperty)

being called with aProperty == eCSSProperty_UNKNOWN which fails miserably. I've
added a check for this in nsCSSDeclaration::RemoveProperty and that seems to
work. Patch coming up.

Comment 5

[Rene Pronk]

Oops, changing back OS. And assigning to me.

Comment 6

[Rene Pronk]

Attachment: patch

Comment 7

[Bernard Alleysson]

also crashes 1.7rc2: TB75056H
requesting blocking1.7 (bug has a patch)

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I think a better solution would be to take a tiny piece of the patch in bug
243728 and just define CSS_PROP_NOTIMPLEMENTED differently.

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Actually, never mind that, we should tolerate bad strings passed to setProperty
/ removeProperty, and bzbarsky can land that later.  However, I think the check
should be in the caller.

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

I prefer checking in the caller.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(The reason I prefer the check in the caller is that I think when we're passing
nsCSSProperty enums around, they should already be known to be good.  There's
only one that isn't, but that should just be like a special return value from
LookupProperty.)

Comment 12

[Rene Pronk]

Yeah, I was having doubts myself whether it should be in the caller or not, but
since I didn't know how many callers there are to the callee I thought I'd just
play it safe and put it in the callee and thereby protect all callers. To me it
doesn't really matter.

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

There's only one caller. :-)

Comment 14

[Manuel Oetiker]

Confirming with build 
Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.7) Gecko/20040607

Comment 15

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Taking bug (although thanks for your work in finding the problem).

Comment 16

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to trunk, 2004-06-07 12:30 -0700.

Comment 17

[chris hofmann]

Comment on attachment 150092 [details] [diff] [review]
patch

a=chofmann for 1.7

Comment 18

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to MOZILLA_1_7_BRANCH, 2004-06-07 14:18 -0700.

Comment 19

[Boris Zbarsky [:bzbarsky]]

*** Bug 245895 has been marked as a duplicate of this bug. ***

Comment 20

[Karen Huang]

Verified as fix on latest 1.7 branch 06-24 build.
Changing keywords from fixed1.7 to verified1.7.
Leave this bug status "as is" until this bug be verified on trunk again...