Last Comment Bug 307809 - Crash involving nested elements with style="display: -moz-grid-group;" [@ nsGridRowLayout::GetGrid]
: Crash involving nested elements with style="display: -moz-grid-group;" [@ nsG...
[sg:nse null-deref]
: crash, fixed1.8.1, verified1.8.0.8
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: PowerPC Mac OS X
: -- critical (vote)
: mozilla1.9alpha1
Assigned To: Boris Zbarsky [:bz] (still a bit busy)
: Jet Villegas (:jet)
Depends on:
Blocks: randomstyles 314502
  Show dependency treegraph
Reported: 2005-09-09 16:21 PDT by Jesse Ruderman
Modified: 2011-06-13 10:01 PDT (History)
8 users (show)
mtschrep: blocking1.8.1+
dveditz: blocking1.8.0.7-
dveditz: blocking1.8.0.8+
bob: in‑testsuite?
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

apple crash report with stack trace (26.96 KB, text/plain)
2005-09-09 16:24 PDT, Jesse Ruderman
no flags Details
reduced testcase (245 bytes, text/html)
2005-10-04 23:20 PDT, Jesse Ruderman
no flags Details
Proposed fix (1.26 KB, patch)
2005-10-05 18:02 PDT, Boris Zbarsky [:bz] (still a bit busy)
dbaron: review+
dbaron: superreview+
dveditz: approval1.8.0.8+
mtschrep: approval1.8.1+
Details | Diff | Splinter Review

Description Jesse Ruderman 2005-09-09 16:21:46 PDT
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050908

Filing as security-sensitive because the testcase includes code from bug 306939
and I didn't manage to make a simplified testcase.
Comment 1 Jesse Ruderman 2005-09-09 16:22:34 PDT
Created attachment 195480 [details]
testcase (not reduced)

Crashes while the status bar counter says 1411.
Comment 2 Jesse Ruderman 2005-09-09 16:24:19 PDT
Created attachment 195481 [details]
apple crash report with stack trace
Comment 3 Jesse Ruderman 2005-10-04 23:20:34 PDT
Created attachment 198548 [details]
reduced testcase
Comment 4 Boris Zbarsky [:bz] (still a bit busy) 2005-10-05 18:02:32 PDT
Created attachment 198651 [details] [diff] [review]
Proposed fix

The nsGrid::GetScrolledBox will happily return non-boxes if it's passed one,
but if it gets a scrollframe for a non-box it'll return null.  So we need to
guard against it here.	Or change what nsGrid::GetScrolledBox does.
Comment 5 Boris Zbarsky [:bz] (still a bit busy) 2005-11-08 19:11:42 PST
Comment 6 Daniel Veditz [:dveditz] 2006-07-06 19:50:59 PDT
Any reason not to take this safe fix on the 1.8/1.8.0 branches?
Comment 7 Boris Zbarsky [:bz] (still a bit busy) 2006-07-14 14:01:26 PDT
Main reason is that I have no idea what this code really does and what the implications of this change really are...
Comment 8 Mike Schroepfer 2006-08-15 12:28:49 PDT
DBaron - any thoughts on risk for 1.8 branch?
Comment 9 Daniel Veditz [:dveditz] 2006-08-22 14:59:15 PDT
Minusing for based on Boris's discomfort (might be trading a safe null-deref for a worse crash elsewhere). We'll do more testing on the trunk and see if this can go into safely.
Comment 10 Mike Schroepfer 2006-08-22 18:54:57 PDT
DBaron/Bz any thoughts for 1.8.1?  If we are going to take this for we'll need it for 1.8.1 as well.. 
Comment 11 David Baron :dbaron: ⌚️UTC-8 2006-09-12 11:47:12 PDT
Boris:  I'm pretty happy with this patch.  The code being changed is determining if the child's layout manager is an nsIGridPart.  If it's not a box at all, then it's certainly doesn't have an nsIGridPart layout manager (nsFrame's box code is nothing like an nsIGridPart).  So it seems quite safe to me.

Are you still concerned with the patch?
Comment 12 Boris Zbarsky [:bz] (still a bit busy) 2006-09-12 12:00:43 PDT
No, as long as someone understands why this is generally the right thing to do, I'm happy.
Comment 13 Mike Schroepfer 2006-09-12 16:21:23 PDT
Comment on attachment 198651 [details] [diff] [review]
Proposed fix

a=schrep for 181drivers.
Comment 14 David Baron :dbaron: ⌚️UTC-8 2006-09-12 23:54:56 PDT
Checked in to MOZILLA_1_8_BRANCH.
Comment 15 Daniel Veditz [:dveditz] 2006-09-19 15:54:18 PDT
Restoring lost blocking flag
Comment 16 Daniel Veditz [:dveditz] 2006-09-26 14:50:53 PDT
Comment on attachment 198651 [details] [diff] [review]
Proposed fix

approved for 1.8.0 branch, a=dveditz for drivers
Comment 17 Boris Zbarsky [:bz] (still a bit busy) 2006-10-06 06:52:43 PDT
Fixed on 1.8.0 branch for
Comment 18 Jay Patel [:jay] 2006-10-20 14:37:18 PDT
v.fixed on 1.8.0 branch with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv: Gecko/20061020 Firefox/, no crash with reduced testcase.

Note You need to log in before you can comment on or make changes to this bug.