Last Comment Bug 348729 - [FIX]Crash [@ nsRuleNode::GetParentData] with :first-letter anonymous content and removing styles
: [FIX]Crash [@ nsRuleNode::GetParentData] with :first-letter anonymous content...
[sg:critical] regression from 264914
: crash, regression, testcase, verified1.8.0.7, verified1.8.1
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: All All
P1 critical (vote)
: mozilla1.8.1
Assigned To: Boris Zbarsky [:bz] (still a bit busy)
: Jet Villegas (:jet)
Depends on:
Blocks: 264914
  Show dependency treegraph
Reported: 2006-08-15 07:36 PDT by Martijn Wargers [:mwargers]
Modified: 2011-06-13 10:01 PDT (History)
5 users (show)
dveditz: blocking1.7.14-
dveditz: blocking‑aviary1.0.9-
dbaron: blocking1.8.1+
dveditz: blocking1.8.0.7+
bob: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (735 bytes, text/html)
2006-08-15 07:37 PDT, Martijn Wargers [:mwargers]
no flags Details
Fix (2.38 KB, patch)
2006-08-15 10:08 PDT, Boris Zbarsky [:bz] (still a bit busy)
roc: review+
roc: superreview+
dveditz: approval1.8.0.7+
dbaron: approval1.8.1+
Details | Diff | Splinter Review
Branch version of patch (2.28 KB, patch)
2006-08-17 08:00 PDT, Boris Zbarsky [:bz] (still a bit busy)
no flags Details | Diff | Splinter Review

Description User image Martijn Wargers [:mwargers] 2006-08-15 07:36:41 PDT
See upcoming testcase, which crashes for me on load. Usually, it crashes for me the first time. If it doesn't, try reloading a few times.

Talkback ID: TB22114083K
nsRuleNode::GetParentData   nsStyleContext::GetStyleData   nsRuleNode::WalkRuleTree   nsRuleNode::GetVisibilityData  

This is a regression.
It doesn't crash in a 2004-10-29 build, it crashes in a 2005-05-06 build.
Comment 1 User image Martijn Wargers [:mwargers] 2006-08-15 07:37:21 PDT
Created attachment 233782 [details]
Comment 2 User image Martijn Wargers [:mwargers] 2006-08-15 07:38:34 PDT
Created attachment 233783 [details]
original file
Comment 4 User image Boris Zbarsky [:bz] (still a bit busy) 2006-08-15 10:08:59 PDT
Created attachment 233798 [details] [diff] [review]

Yeah, this is a regression from bug 264914.  The problem is that when we remove the <tfoot>'s abs pos frame we also remove the placeholder.  So we hit that first hunk in this patch, which clobbers parentFrame to be the parent of the placeholder.  Then we use parentFrame to construct the frame constructor state for recovering the letter frames.  And the patch for bug 264914 made us use the frame constructor state to determine the float parent, so we put the float on totally the wrong float list, and things break.

The first hunk of the patch makes us not clobber parentFrame and is enough to fix this bug; the second hunk just avoids an extraneous call to GetFloatContainingBlock.
Comment 5 User image Boris Zbarsky [:bz] (still a bit busy) 2006-08-15 10:11:04 PDT
We should get this in on branches too.
Comment 6 User image Robert O'Callahan (:roc) (email my personal email if necessary) 2006-08-15 14:44:15 PDT
Comment on attachment 233798 [details] [diff] [review]

looks branch-good to me
Comment 7 User image Boris Zbarsky [:bz] (still a bit busy) 2006-08-15 15:31:26 PDT
Fixed on trunk.
Comment 8 User image David Baron :dbaron: ⌚️UTC-8 2006-08-16 10:23:29 PDT
Comment on attachment 233798 [details] [diff] [review]

a=dbaron on behalf of drivers.  Please land on MOZILLA_1_8_BRANCH and add the fixed1.8.1 keyword once you have done so.
Comment 9 User image Daniel Veditz [:dveditz] 2006-08-16 14:16:31 PDT
Comment on attachment 233798 [details] [diff] [review]

approved for 1.8.0 branch, a=dveditz for drivers
Comment 10 User image Boris Zbarsky [:bz] (still a bit busy) 2006-08-17 08:00:43 PDT
Created attachment 234223 [details] [diff] [review]
Branch version of patch
Comment 11 User image Boris Zbarsky [:bz] (still a bit busy) 2006-08-17 08:01:29 PDT
Fixed for 1.8.1 and
Comment 12 User image Bob Clary [:bc:] 2006-08-22 11:30:23 PDT
ff2b2 debug/nightly windows/linux no crash

###!!! ASSERTION: out of bounds: 'PRInt32(aIndex) >= 0 && aIndex <= length', file /work/mozilla/builds/ff/2.0/mozilla/layout/base/nsChildIterator.h, line 133
Break: at file /work/mozilla/builds/ff/2.0/mozilla/layout/base/nsChildIterator.h, line 133
###!!! ASSERTION: Float frame has wrong parent: 'floatFrame->GetParent() == mBlock', file /work/mozilla/builds/ff/2.0/mozilla/layout/generic/nsBlockReflowState.cpp, line 835
Break: at file /work/mozilla/builds/ff/2.0/mozilla/layout/generic/nsBlockReflowState.cpp, line 835

verified fixed 1.8
Comment 13 User image alice nodelman [:alice] [:anode] 2006-08-22 16:37:35 PDT should not crash browser.

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv: Gecko/20060821 Firefox/

Comment 14 User image Daniel Veditz [:dveditz] 2006-09-07 10:36:23 PDT
Given the regression window this is not a problem on the 1.7/aviary branches, right?
Comment 15 User image Bob Clary [:bc:] 2009-04-24 11:01:03 PDT
crash test landed

Note You need to log in before you can comment on or make changes to this bug.