MathML/DOM crash [@ nsMathMLContainerFrame::GetType]

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
13 years ago
11 years ago

People

(Reporter: jruderman, Assigned: rbs)

Tracking

(Blocks: 1 bug, {crash, testcase, verified1.8})

Trunk
crash, testcase, verified1.8
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

405 bytes, application/xhtml+xml
Details
fix
4.23 KB, patch
bzbarsky
: review+
bzbarsky
: superreview+
Details | Diff | Splinter Review
648 bytes, application/xhtml+xml
Details
(Reporter)

Description

13 years ago
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050908
Firefox/1.6a1

TB9203727M
(Reporter)

Comment 1

13 years ago
Created attachment 195509 [details]
reduced testcase
(Reporter)

Comment 2

13 years ago
Assuming this crash is due to calling GetType on a deleted frame, bz thinks this
isn't an exploitable crash in opt builds, because frames are arena-allocated and
the arena isn't recycled until the page goes away.
(Assignee)

Comment 3

13 years ago
Created attachment 195691 [details] [diff] [review]
fix

Move the null checks inside functions. This way we can take away the early
returns in the other codes and give them a chance to continue updating the
remaing states of the frames, even when the underlying markup is invalid.
Attachment #195691 - Flags: superreview?(bzbarsky)
Attachment #195691 - Flags: review?(bzbarsky)
Attachment #195691 - Flags: superreview?(bzbarsky)
Attachment #195691 - Flags: superreview+
Attachment #195691 - Flags: review?(bzbarsky)
Attachment #195691 - Flags: review+
(Assignee)

Updated

13 years ago
Attachment #195691 - Flags: approval1.8b5?
Created attachment 195769 [details]
Testcase2

With this testcase, I get approximately crashes with the same stacktrace:
TB9278959K TB9278831M
So this is probably also fixed with the patch.
(Assignee)

Comment 5

13 years ago
Checked in the trunk yesterday. So today's builds now have the fix.
Status: NEW → RESOLVED
Last Resolved: 13 years ago
OS: MacOS X → All
Hardware: Macintosh → All
Resolution: --- → FIXED
Yup, verified with 2005-09-12 build.
Status: RESOLVED → VERIFIED

Updated

13 years ago
Attachment #195691 - Flags: approval1.8b5? → approval1.8b5+
(Assignee)

Comment 7

13 years ago
Checked in the 1.8 branch.
Keywords: fixed1.8

Comment 8

13 years ago
v.fixed on branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5)
Gecko/20050928 Firefox/1.4, testcases don't crash and no crashes since 9/12 in
Talkback data.
Keywords: fixed1.8 → verified1.8
(Reporter)

Comment 9

11 years ago
Crashtests checked in.
Flags: in-testsuite+
Crash Signature: [@ nsMathMLContainerFrame::GetType]
You need to log in before you can comment on or make changes to this bug.