422011 - crashes [@ nsCSSValue::nsCSSValue] copy constructor due to float assignment on uninitialized data

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I noticed a few of these incidents on crash-stats.mozilla.org : this crash is currently #80 for Fx 3.0b4.  I'm surprised it's not higher.

I'll attach a sample incident and a patch.  The problem is that nsCSSValue's copy constructor does float assignment in the else case, which looks like (at least on Windows) is compiled to something that uses floating point instructions, which can fault when certain bad float values are used.  (See bug 302536 for some more details.)

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: incident a38720e3-ed40-11dc-b458-001a4bd43e5c

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

I made a case for the valueless units in the copy constructor, and moved what seemed to me to be the most common cases to the front.  I also made the Dummy unit work a little better and cleaned up the whitespace/parens in the copy ctor.

Compiles and passes layout/style/test/ mochitests.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 308556 [details] [diff] [review]
patch

r+sr=bzbarsky. Can we try to get in a crashtest for this?

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 308556 [details] [diff] [review]
patch

Simple fix for a not-quite-top-crash.

Comment 5

[Damon Sicore (:damons)]

Comment on attachment 308556 [details] [diff] [review]
patch

a1.9+=damons

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I don't think a crashtest is practical since if this crashed reliably Firefox would crash on startup.

Fix checked in to trunk, 2008-03-12 15:05 -0700.