323022 - Crash [@ nsSpaceManager::GetTranslation() line 196] with null SpaceManager on SVG documents

Status: RESOLVED DUPLICATE of bug 310436

(Core :: Layout: Block and Inline, defect)

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: stacks+assertions

Comment 2

[Daniel Veditz [:dveditz]]

doesn't look exploitable, lots of null pointers.

Comment 3

[Jesse Ruderman]

Attachment: reduced testcase (crashes at nsSpaceManager::GetTranslation)

Crashes in nsSpaceManager::GetTranslation, called by nsBlockBandData::Init.  In a release build, the Mac OS X crash report tool shows nsBlockBandData::Init at the top, probably because nsSpaceManager::GetTranslation gets inlined.

Comment 5

[Jesse Ruderman]

Attachment: non-reduced testcase (crashes at PL_DHashTableFinish)

0    PL_DHashTableFinish + 168
1    nsPropertyTable::GetPropertyInternal(void const*, unsigned, nsIAtom*, int, unsigned*) + 80
2    nsBlockFrame::GetFirstChild(nsIAtom*) const + 128
3    nsCSSFrameConstructor::FindFrameWithContent(nsFrameManager*, nsIFrame*, nsIContent*, nsIContent*, nsFindFrameHint*) + 244
4    nsCSSFrameConstructor::FindFrameWithContent(nsFrameManager*, nsIFrame*, nsIContent*, nsIContent*, nsFindFrameHint*) + 396

Comment 6

[Jesse Ruderman]

Attachment: non-reduced testcase (crashes at nsCSSFrameConstructor::ReinsertContent with a random address on top)

0    0 + 38572876
1    nsCSSFrameConstructor::ReinsertContent(nsIContent*, nsIContent*) + 676
2    nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, int, int) + 432
3    nsCSSFrameConstructor::ReinsertContent(nsIContent*, nsIContent*) + 80
4    nsCSSFrameConstructor::WipeContainingBlock(nsFrameConstructorState&, nsIFrame*, nsIFrame*, nsIFrame*) + 468
5    nsCSSFrameConstructor::ContentAppended(nsIContent*, int) + 2380

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Is this fixed by the patch in bug 310436?

Comment 8

[Jesse Ruderman]

Yes.  None of the attachments here crash in a debug build with that patch applied.

Comment 9

[Jesse Ruderman]

And fixed in opt builds from atlantia (yesterday's nightly crashes; a very recent hourly doesn't), now that the patch in bug 310436 has been checked in :)

Should this be marked as fixed, wfm, or dup?

Comment 10

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 310436 ***