Last Comment Bug 384344 - free memory read at nsCachedStyleData:GetStyleData within DoDeletingFrameSubtree
: free memory read at nsCachedStyleData:GetStyleData within DoDeletingFrameSubtree
Status: RESOLVED FIXED
[sg:critical?] 1.8-branch only
: crash, testcase, verified1.8.0.13, verified1.8.1.5
Product: Core
Classification: Components
Component: Layout (show other bugs)
: 1.8 Branch
: x86 Linux
: -- critical (vote)
: ---
Assigned To: Mats Palmgren (:mats)
:
: Jet Villegas (:jet)
Mentors:
Depends on: 322436 366128
Blocks:
  Show dependency treegraph
 
Reported: 2007-06-13 14:21 PDT by Paul Nickerson
Modified: 2009-04-24 10:44 PDT (History)
10 users (show)
dveditz: blocking1.8.1.5+
dveditz: wanted1.8.1.x+
dveditz: blocking1.8.0.13+
dveditz: wanted1.8.0.x+
bob: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Testcase (288 bytes, text/html)
2007-06-13 14:21 PDT, Paul Nickerson
no flags Details
stack (6.21 KB, text/plain)
2007-06-13 16:50 PDT, Mats Palmgren (:mats)
no flags Details
patch (4.03 KB, patch)
2007-06-13 16:52 PDT, Mats Palmgren (:mats)
dveditz: review+
dveditz: superreview+
dveditz: approval1.8.1.5+
dveditz: approval1.8.0.13+
Details | Diff | Splinter Review
A few remaining assertions after patch (5.82 KB, text/plain)
2007-06-13 17:21 PDT, Mats Palmgren (:mats)
no flags Details

Description Paul Nickerson 2007-06-13 14:21:23 PDT
Created attachment 268270 [details]
Testcase

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1223562608 (LWP 4878)]
0x085bf5b9 in nsCachedStyleData::GetStyleData (this=0xddddddf9, 
    aSID=@0xbfe65950)
    at /home/pvnick/Desktop/mozilla/layout/style/nsRuleNode.h:210
210         char* resetOrInherit = NS_REINTERPRET_CAST(char*, *NS_REINTERPRET_CAST(void**, resetOrInheritSlot));

(gdb) print resetOrInheritSlot
$1 = 0xddddddfd <Address 0xddddddfd out of bounds>

(gdb) bt
#0  0x085bf5b9 in nsCachedStyleData::GetStyleData (this=0xddddddf9, 
    aSID=@0xbfe65950)
    at /home/pvnick/Desktop/mozilla/layout/style/nsRuleNode.h:210
#1  0x085c1b28 in nsStyleContext::GetStyleData (this=0xdddddddd, 
    aSID=eStyleStruct_Display)
    at /home/pvnick/Desktop/mozilla/layout/style/nsStyleContext.cpp:248
#2  0x08435842 in nsIFrame::GetStyleData (this=0xb145adf0, 
    aSID=eStyleStruct_Display)
    at /home/pvnick/Desktop/mozilla/layout/mathml/base/src/../../../generic/nsIFrame.h:608
#3  0x0843585d in nsIFrame::GetStyleDisplay (this=0xb145adf0)
    at ../../../dist/include/layout/nsStyleStructList.h:90
#4  0x08413d51 in DoDeletingFrameSubtree (aPresContext=0xb1481fe8, 
    aFrameManager=0xb14aec6c, aDestroyQueue=@0xbfe65a90, 
    aRemovedFrame=0xaf55b9c8, aFrame=0xaf55bad0)
    at /home/pvnick/Desktop/mozilla/layout/base/nsCSSFrameConstructor.cpp:9755
#5  0x08413d21 in DoDeletingFrameSubtree (aPresContext=0xb1481fe8, 
    aFrameManager=0xb14aec6c, aDestroyQueue=@0xbfe65a90, 
    aRemovedFrame=0xaf55b9c8, aFrame=0xaf55b9c8)
    at /home/pvnick/Desktop/mozilla/layout/base/nsCSSFrameConstructor.cpp:9740
#6  0x084150f5 in DeletingFrameSubtree (aPresContext=0xb1481fe8, 
    aFrameManager=0xb14aec6c, aFrame=0xaf55b9c8)
    at /home/pvnick/Desktop/mozilla/layout/base/nsCSSFrameConstructor.cpp:9812
Comment 1 Mats Palmgren (:mats) 2007-06-13 16:49:43 PDT
I think this is a duplicate of bug 366128 / bug 322436...
Comment 2 Mats Palmgren (:mats) 2007-06-13 16:50:15 PDT
Created attachment 268289 [details]
stack
Comment 3 Mats Palmgren (:mats) 2007-06-13 16:52:38 PDT
Created attachment 268290 [details] [diff] [review]
patch

Merging rev. 1.1352 -> 1.1353  +  rev. 1.1354 -> 1.1355 of
layout/base/nsCSSFrameConstructor.cpp fixes the crash.
There are still a few line layout assertions though...
Comment 4 Boris Zbarsky [:bz] (still a bit busy) 2007-06-13 17:06:56 PDT
What assertions?
Comment 5 Mats Palmgren (:mats) 2007-06-13 17:21:15 PDT
Created attachment 268292 [details]
A few remaining assertions after patch

I happened to have a diagnostic frame dump on the "How'd we get a
floated inline frame?" assertion in this tree so I'm including that as well.
Comment 6 Daniel Veditz [:dveditz] 2007-07-09 11:34:07 PDT
Do we need to fix those assertions? If we've got a fix for a crash involving deleted objects that sounds like good progress to get into FF2.0.0.5.

Time is tight: please get some reviews and request approval on this.
Comment 7 Daniel Veditz [:dveditz] 2007-07-11 12:03:25 PDT
Comment on attachment 268290 [details] [diff] [review]
patch

r/sr=bzbarsky over IRC
approved for 1.8.1.5 and 1.8.0.13, a=dveditz
Comment 8 Mats Palmgren (:mats) 2007-07-11 13:55:10 PDT
MOZILLA_1_8_BRANCH
mozilla/layout/base/nsCSSFrameConstructor.cpp 	1.1110.6.81 

MOZILLA_1_8_0_BRANCH
mozilla/layout/base/nsCSSFrameConstructor.cpp 	1.1110.6.12.2.58 

-> FIXED
Comment 9 Carsten Book [:Tomcat] 2007-07-12 18:15:58 PDT
verified fixed 1.8.1.5 using Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.5pre) Gecko/2007071216 BonEcho/2.0.0.5pre and the Testcase from comment 0 . No crash on testcase - build remain stable - adding verified keyword.
Comment 10 Al Billings [:abillings] 2007-08-21 17:48:01 PDT
verified fixed in 1.8.0.13 using Thunderbird build 2007080918 on Windows XP (en-US). No crash with test case.
Comment 11 Bob Clary [:bc:] 2009-04-24 10:44:12 PDT
crash test landed
http://hg.mozilla.org/mozilla-central/rev/d849dbf33b4f

Note You need to log in before you can comment on or make changes to this bug.