-moz-key-equivalent related Crash [@ nsRuleNode::WalkRuleTree?]

RESOLVED FIXED in mozilla1.8alpha5

Status

()

defect
P2
critical
RESOLVED FIXED
15 years ago
10 years ago

People

(Reporter: thomas+mozilla, Assigned: dbaron)

Tracking

(4 keywords)

Trunk
mozilla1.8alpha5
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [patch], crash signature)

Attachments

(4 attachments, 1 obsolete attachment)

Reporter

Description

15 years ago
User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.5 (KHTML, like Gecko) Safari/125.9
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a5) Gecko/20041020 Firefox/0.9.1+

I added mozilla specific CSS to my browser QA software - http://toadstool.se/software/iexploder2/ 
and caught this one. It crashes in FireFox 0.10.0 and the 20041020 nightly build. It seems that if you 
mix -moz-key-equivalent with a textarea, you get a crash.



Reproducible: Always
Steps to Reproduce:




Stack Trace:

Thread 0 Crashed:
0   org.mozilla.firefox 	0x00940314 0x1000 + 0x93f314
1   org.mozilla.firefox 	0x002b1578 nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*, 
nsRuleData*, nsCSSStruct*) + 0xf0
2   org.mozilla.firefox 	0x002b0ab8 nsRuleNode::GetUIResetData(nsStyleContext*) + 0x8c
3   org.mozilla.firefox 	0x002b8010 nsRuleNode::GetStyleData(nsStyleStructID, nsStyleContext*, int) 
+ 0x1d8
4   org.mozilla.firefox 	0x00346cec nsStyleContext::GetStyleData(nsStyleStructID) + 0x50
Reporter

Comment 1

15 years ago
Note: clicking on this test case will crash your web browser
confirming with win2k build 20041023..
Assignee: general → dbaron
Status: UNCONFIRMED → NEW
Component: Browser-General → Style System (CSS)
Ever confirmed: true
Keywords: crash
QA Contact: general → ian

Comment 3

15 years ago
Posted file stacktrace —

Updated

15 years ago
Keywords: testcase
The assert that happens well before the crash explains the problem pretty
clearly.  KeyEquvalent is typed as a ValueList and appears that way in
nsCSSStruct, but it's parsed as a single value property (and has been since
before bug 125246).
Posted patch patch (obsolete) — — Splinter Review
This is an unused -moz-* property, nobody knows what it was supposed to do, and
it's not even half implemented.  Let's remove it.
Posted patch patch — — Splinter Review
Attachment #163175 - Attachment is obsolete: true
Attachment #163176 - Flags: superreview?(bzbarsky)
Attachment #163176 - Flags: review?(bzbarsky)
Comment on attachment 163176 [details] [diff] [review]
patch

r+sr=bzbarsky
Attachment #163176 - Flags: superreview?(bzbarsky)
Attachment #163176 - Flags: superreview+
Attachment #163176 - Flags: review?(bzbarsky)
Attachment #163176 - Flags: review+
Comment on attachment 163176 [details] [diff] [review]
patch

Very low risk crash fix -- may as well take it.
Attachment #163176 - Flags: approval1.7.x?
Attachment #163176 - Flags: approval-aviary?

Comment 9

15 years ago
Comment on attachment 163176 [details] [diff] [review]
patch

a=asa for aviary and 1.7 checkin.
Attachment #163176 - Flags: approval1.7.x?
Attachment #163176 - Flags: approval1.7.x+
Attachment #163176 - Flags: approval-aviary?
Attachment #163176 - Flags: approval-aviary+
Posted patch patch for branch — — Splinter Review
(This also contains a few (trivial) things I missed in the previous patch.)
Fix checked in to trunk, 2004-10-23 21:32/43 -0700.
Fix checked in to AVIARY_1_0_20040515_BRANCH, 2004-10-23 21:49 -0700.
Fix checked in to MOZILLA_1_7_BRANCH, 2004-10-23 21:51 -0700.
Status: NEW → RESOLVED
Last Resolved: 15 years ago
Priority: -- → P2
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.8alpha5

Updated

14 years ago
Blocks: iexploder

Comment 12

10 years ago
in-testsuite-: this was fixed by removing all traces of support for 
"-moz-key-equivalent", whatever that used to be.
Flags: in-testsuite-
Crash Signature: [@ nsRuleNode::WalkRuleTree?]
You need to log in before you can comment on or make changes to this bug.