377216 - [FIX]Possible to reflow while quote/counter lists are dirty

Status: RESOLVED FIXED

(Core :: Layout, defect, P1)

Description

[Boris Zbarsky [:bzbarsky]]

If a reflow flush happens in the middle of an update (e.g. document.body.offsetWidth is accessed in a mutation event handler) on a page with quotes or counters, it's possible to reflow while the quote/counter lists have dangling pointers...  This is pretty undesirable.

I don't have a testcase that demonstrates a problem here, offhand, but I bet fuzz-testing could find one!

Comment 1

[Boris Zbarsky [:bzbarsky]]

Though I would also be interested in seeing whether the quote/counter flush triggers mutation events for the text content changes!

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Perhaps like so

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 261311 [details] [diff] [review]
Perhaps like so

r+sr=dbaron

Comment 4

[Boris Zbarsky [:bzbarsky]]

Checked in on trunk.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 261311 [details] [diff] [review]
Perhaps like so

I think this is a pretty safe patch that we should take on 1.8.

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 261311 [details] [diff] [review]
Perhaps like so

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: Merged to branch

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed on both branches.

Comment 9

[Samuel Sidler (old account; do not CC)]

Is there a good way to verify this bug without a testcase?

Comment 10

[Boris Zbarsky [:bzbarsky]]

No.  We need to create a testcase if we're serious about verifying it...