Evil testcase using drop down list crashes Mozilla [@ nsCachedStyleData::GetStyleData]

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
13 years ago
8 years ago

People

(Reporter: martijn.martijn, Unassigned)

Tracking

({crash, regression, testcase})

Trunk
x86
Windows XP
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9a1 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

13 years ago
See upcoming testcase.
Hovering over the drop down list should not crash Mozilla, but it crashes for me
in 2005-09-28 trunk build.
Talkback ID: TB9876033K

Surprisingly, it doesn't crash Mozilla1.7. I'll look for the regression range.
(Reporter)

Comment 1

13 years ago
Created attachment 197919 [details]
testcase
(Reporter)

Comment 2

13 years ago
Actually, this is a recent regression.
Testcase doesn't crash with 2005-09-20 build, but crashes with 2005-09-21 build:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-09-20+06%3A00%3A00&maxdate=2005-09-21+08%3A00%3A00&cvsroot=%2Fcvsroot
Most likely a fall-out from bug 117984
Blocks: 117984
Either that or maybe bug 307277...

Mats, could you check this out?
Blocks: 307277
Flags: blocking1.9a1+

Comment 4

13 years ago
This might be a dup of bug 310426.
(Reporter)

Updated

13 years ago
Depends on: 315752

Comment 5

13 years ago
Backing out the patch for bug 117984 does fix the testcase here. Backing out bug 307277 does not fix this.

Comment 6

13 years ago
Created attachment 204255 [details]
stacktrace from testcase

Updated

13 years ago
Summary: Evil testcase using drop down list crashes Mozilla → Evil testcase using drop down list crashes Mozilla [@ nsCachedStyleData::GetStyleData]

Comment 7

13 years ago
Fixed by the patch for bug 315752.
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED
(Reporter)

Comment 8

13 years ago
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20051220 Firefox/1.6a1
Status: RESOLVED → VERIFIED
(Assignee)

Updated

8 years ago
Crash Signature: [@ nsCachedStyleData::GetStyleData]
You need to log in before you can comment on or make changes to this bug.