265721 - -moz-key-equivalent related Crash [@ nsRuleNode::WalkRuleTree?]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P2)

Description

[Thomas Stromberg]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.5 (KHTML, like Gecko) Safari/125.9
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a5) Gecko/20041020 Firefox/0.9.1+

I added mozilla specific CSS to my browser QA software - http://toadstool.se/software/iexploder2/ 
and caught this one. It crashes in FireFox 0.10.0 and the 20041020 nightly build. It seems that if you 
mix -moz-key-equivalent with a textarea, you get a crash.



Reproducible: Always
Steps to Reproduce:




Stack Trace:

Thread 0 Crashed:
0   org.mozilla.firefox 	0x00940314 0x1000 + 0x93f314
1   org.mozilla.firefox 	0x002b1578 nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*, 
nsRuleData*, nsCSSStruct*) + 0xf0
2   org.mozilla.firefox 	0x002b0ab8 nsRuleNode::GetUIResetData(nsStyleContext*) + 0x8c
3   org.mozilla.firefox 	0x002b8010 nsRuleNode::GetStyleData(nsStyleStructID, nsStyleContext*, int) 
+ 0x1d8
4   org.mozilla.firefox 	0x00346cec nsStyleContext::GetStyleData(nsStyleStructID) + 0x50

Comment 1

[Thomas Stromberg]

Attachment: Test Case 100482: body style moz-equivalent, textarea

Note: clicking on this test case will crash your web browser

Comment 2

[Matthias Versen [:Matti]]

confirming with win2k build 20041023..

Comment 3

[Andrew Schultz]

Attachment: stacktrace

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The assert that happens well before the crash explains the problem pretty
clearly.  KeyEquvalent is typed as a ValueList and appears that way in
nsCSSStruct, but it's parsed as a single value property (and has been since
before bug 125246).

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

This is an unused -moz-* property, nobody knows what it was supposed to do, and
it's not even half implemented.  Let's remove it.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 163176 [details] [diff] [review]
patch

r+sr=bzbarsky

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 163176 [details] [diff] [review]
patch

Very low risk crash fix -- may as well take it.

Comment 9

[Asa Dotzler [:asa]]

Comment on attachment 163176 [details] [diff] [review]
patch

a=asa for aviary and 1.7 checkin.

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch for branch

(This also contains a few (trivial) things I missed in the previous patch.)

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fix checked in to trunk, 2004-10-23 21:32/43 -0700.
Fix checked in to AVIARY_1_0_20040515_BRANCH, 2004-10-23 21:49 -0700.
Fix checked in to MOZILLA_1_7_BRANCH, 2004-10-23 21:51 -0700.

Comment 12

[Jesse Ruderman]

in-testsuite-: this was fixed by removing all traces of support for 
"-moz-key-equivalent", whatever that used to be.