"ASSERTION: Some objects allocated with AllocateFrame were not freed" with xul:menulist, xul:tooltip

VERIFIED FIXED in mozilla1.9beta1

Status

()

defect
--
critical
VERIFIED FIXED
12 years ago
11 years ago

People

(Reporter: jruderman, Assigned: mats)

Tracking

(Blocks 1 bug, {assertion, crash, testcase})

Trunk
mozilla1.9beta1
Points:
---
Dependency tree / graph
Bug Flags:
blocking1.9 +
wanted1.8.1.x -
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical?][dbaron-1.9:Rs])

Attachments

(3 attachments)

Reporter

Description

12 years ago
###!!! ASSERTION: Shallow unbind won't clear document and binding parent on kids!: 'aDeep || (!GetCurrentDoc() && !GetBindingParent())', file /Users/jruderman/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 2090

###!!! ASSERTION: Some objects allocated with AllocateFrame were not freed: 'mFrameCount == 0', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 673

This bug appears to be exploitable via the usual method for exploiting "ASSERTION: Some objects allocated with AllocateFrame were not freed" bugs.
Flags: blocking1.9?
Reporter

Comment 2

12 years ago
You have to reload to see the second assertion, as usual.
Reporter

Updated

12 years ago
Whiteboard: [sg:critical?]
Assignee

Comment 3

12 years ago
We're calling nsMenuFrame::InsertFrames with aPrevFrame == the popup frame
on its ::popupList although we insert the new frame into the principal list.
This is same problem as we had with nsFieldSetFrame when aPrevFrame was
the legend frame in bug 345249.  Patch coming up.
Assignee: nobody → mats.palmgren
Flags: in-testsuite?
OS: Mac OS X → All
Hardware: PC → All
Assignee

Comment 4

12 years ago
Posted file Mochitest (.tar.gz)
Assignee

Comment 5

12 years ago
Posted patch Patch rev. 1Splinter Review
Fixes the second assertion (and the crash I hope -- Jesse, confirm?).
The first assertion still occurs but I think it's unrelated and can
be handled in a separate bug.
Attachment #279581 - Flags: superreview?(enndeakin)
Attachment #279581 - Flags: review?(enndeakin)
Reporter

Comment 6

12 years ago
make[5]: *** No rule to make target `/Users/jruderman/trunk/mozilla/layout/xul/test/Makefile.in', needed by `test/Makefile'.  Stop.

Did you forget to include your new tests in the patch?
Reporter

Comment 7

12 years ago
The patch does fix the crash :)
Assignee

Comment 8

12 years ago
(In reply to comment #6)
> Did you forget to include your new tests in the patch?

It's in the attached .tar.gz file.  I don't think it's possible to make
a cvs diff with files in new directories (layout/xul/test), IIRC "cvs add"
of a directory is immediate and I didn't want to affect the repository
without approval.

(In reply to comment #7)
> The patch does fix the crash :)

Thanks!
(In reply to comment #8)
>I don't think it's possible to make a cvs diff with files in new directories
There are third-party utilities that allow this (e.g. cvsdo).

Updated

12 years ago
Attachment #279581 - Flags: superreview?(enndeakin)
Attachment #279581 - Flags: superreview?(bzbarsky)
Attachment #279581 - Flags: review?(enndeakin)
Attachment #279581 - Flags: review+
Comment on attachment 279581 [details] [diff] [review]
Patch rev. 1

sr=bzbarsky
Attachment #279581 - Flags: superreview?(bzbarsky) → superreview+
Assignee

Updated

12 years ago
Attachment #279581 - Flags: approval1.9?
Flags: blocking1.9? → blocking1.9+
Comment on attachment 279581 [details] [diff] [review]
Patch rev. 1

a1.9=dbaron
Attachment #279581 - Flags: approval1.9? → approval1.9+
Whiteboard: [sg:critical?] → [sg:critical?][dbaron-1.9:Rs]
Assignee

Comment 12

12 years ago
mozilla/layout/xul/test/Makefile.in 	1.2
mozilla/layout/xul/test/test_bug394800.xhtml 	1.1
mozilla/layout/xul/base/src/nsBoxFrame.cpp 	1.341
mozilla/layout/xul/base/src/nsMenuFrame.cpp 	1.362 

-> FIXED
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: in-testsuite? → in-testsuite+
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → mozilla1.9 M9

Comment 13

12 years ago
verified fixed 1.9.0 debug no AllocateFrame assertion with attachment 279517 [details] on linux/macppc/windows. Also no assertion on linux/windows with the mochikit test (mac wouldn't run mochikit...)
Status: RESOLVED → VERIFIED
Reporter

Comment 14

11 years ago
This bug doesn't seem to affect branch.  I ported the patch for bug 334514 to branch just to make sure ;)
Group: security
Flags: wanted1.8.1.x-

Updated

11 years ago
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
You need to log in before you can comment on or make changes to this bug.