308999 - [FIX]Crash when changing node.style.background (with non-empty node.style.content) from JavaScript [@ nsStyleDisplay::CalcDifference ]

Status: RESOLVED DUPLICATE of bug 308890

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Danil Ivanov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9a1) Gecko/20050917 Firefox/1.6a1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9a1) Gecko/20050917 Firefox/1.6a1

<p style="content:url('fake.gif');background:url('fake.gif');"
   onclick="this.style.background=this.style.background;">
   crash
</p>

Crash when <p> clicked.

Reproducible: Always

Steps to Reproduce:
1. Set nodes content and background CSS properties.
2. Change background from JavaScript.

Actual Results:  
Mozilla crashes.

Expected Results:  
Mozilla should not crash but background change.

Comment 1

[Danil Ivanov]

Attachment: Crash testcase

Comment 2

[Danil Ivanov]

Comment on attachment 196481 [details]
Crash testcase

<p>Save page on disk, open in Firefox and click on &#171;crash&#187;</p>
<p style="content:url('fake.gif');background:url('fake.gif');"
onclick="this.style.background=this.style.background;">crash</p>

Comment 3

[Danil Ivanov]

I mean... Testcase works only when I open it from disk (not http://).

Comment 4

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050916
Firefox/1.4 ID:2005091619

crash ->New

Incident ID: 9459474
Stack Signature	nsStyleDisplay::CalcDifference 42161a59
Product ID	Firefox15
Build ID	2005091606
Trigger Time	2005-09-17 18:49:52.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	firefox.exe + (00216eb1)
URL visited	
User Comments	bug 308999
Since Last Crash	96477 sec
Total Uptime	96477 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/style/nsStyleStruct.cpp,
line 1220
Stack Trace 	
nsStyleDisplay::CalcDifference 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/style/nsStyleStruct.cpp,
line 1220]
nsStyleContent::~nsStyleContent 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/style/nsStyleStruct.cpp,
line 1368]
nsStyleContext::CalcStyleDifference 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/style/nsStyleContext.cpp,
line 492]
nsFrameManager::ReResolveStyleContext 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsFrameManager.cpp,
line 1195]
nsFrameManager::ReParentStyleContext 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsFrameManager.cpp,
line 953]
nsFrameManager::ReResolveStyleContext 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsFrameManager.cpp,
line 1220]
nsCSSFrameConstructor::RestyleElement 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 10230]
nsCSSFrameConstructor::ProcessOneRestyle 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 13633]
nsCSSFrameConstructor::RestyleEnumerateData::`vector deleting destructor'
nsCSSFrameConstructor::CreateInsertionPointChildren 
[c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp,
line 13757]
SETUPAPI.DLL + 0x30c24 (0x778b0c24)

Comment 5

[Danil Ivanov]

Attachment: Crash testcase (more simple)

Comment 6

[Martijn Wargers (dead)]

This regressed between 2004-07-11 and 2004-07-18

Comment 7

[Martijn Wargers (dead)]

Boris, probably something that needs to be fixed for 1.8, bad regression.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Attachment: mContent.mImage can be null...

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I think I prefer biesi's patch, slightly.

*** This bug has been marked as a duplicate of 308890 ***

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 196652 [details] [diff] [review]
mContent.mImage can be null...

...though this works as well.