444490 - Crash [@ nsCSSStyleSheet::GetOwnerNode] with bindings and style tag in binding

Status: RESOLVED WORKSFORME

(Core :: XBL, defect)

Description

[Martijn Wargers (dead)]

Attachment: binding needed for testcase

See upcoming testcase, which crashes current trunk builds directly, or after a few reloads.
You only get the crash when you have the NoScript extension installed (and you allow scripts on the page): https://addons.mozilla.org/en-US/firefox/addon/722

This regressed when bug 366770 got fixed, and yes, I tried to use fragment identifiers in the urls, but then it doesn't crash at all.

http://crash-stats.mozilla.com/report/index/e1b92899-4e10-11dd-842c-001a4bd43e5c
0  	xul.dll  	ns_if_addref<nsPresContext*>  	 obj-firefox/dist/include/xpcom/nsISupportsUtils.h:114
1 	xul.dll 	nsCSSStyleSheet::GetOwnerNode 	layout/style/nsCSSStyleSheet.cpp:918
2 	xul.dll 	CSSLoaderImpl::InsertSheetInDoc 	layout/style/nsCSSLoader.cpp:1187
3 	xul.dll 	CSSLoaderImpl::LoadInlineStyle 	layout/style/nsCSSLoader.cpp:1711
4 	xul.dll 	xul.dll@0x2dfb88

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase2

Ok, the previous testcase isn't eager to crash, probably because of the loading over the network. When making the browser work offline, it does crash easily.
But anyway, this is using data urls, if that's more convenient.

Comment 3

[Martijn Wargers (dead)]

Comment on attachment 328800 [details]
testcase2

Hrm, never mind, I can't get this one to crash at all.

Comment 4

[Martijn Wargers (dead)]

Attachment: stacktrace from debug build

Comment 5

[:Gavin Sharp [email: [e-mail]]]

Looks like a dupe of bug 432813 (since that bug causes us to blow out the stack, the stack traces aren't going to be consistent).

Comment 6

[Martijn Wargers (dead)]

Well, afaik, there is no recursion involved with the testcase, that I attached.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Not sure about recursion, but the stack from that breakpad incident is clearly busted... at least in frame 0 and frame 4.

Comment 8

[:Gavin Sharp [email: [e-mail]]]

I can't get this to crash using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.2pre) Gecko/2008081815 Minefield/3.0.2pre , for what it's worth. Is this trunk only?

(I also tried loading the binding and testcase locally).

Comment 9

[Martijn Wargers (dead)]

I'm afraid I still crash with the testcase, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1a2pre) Gecko/20080819034536 Minefield/3.1a2pre
Remember that you must have the NoScript extension installed to see the crash happening.

http://crash-stats.mozilla.com/report/index/b4fbf566-6e00-11dd-bded-001a4bd43ef6?p=1
0  	xul.dll  	ns_if_addref<nsIDOMMimeType*>  	 obj-firefox/dist/include/xpcom/nsISupportsUtils.h:114
1 	xul.dll 	nsCSSStyleSheet::GetOwnerNode 	layout/style/nsCSSStyleSheet.cpp:1735
2 	xul.dll 	CSSLoaderImpl::InsertSheetInDoc 	layout/style/nsCSSLoader.cpp:1187
3 	xul.dll 	CSSLoaderImpl::LoadInlineStyle 	layout/style/nsCSSLoader.cpp:1714
4 	xul.dll 	xul.dll@0x2f3a47 	
5 		@0x3a7eacb

Comment 10

[Boris Zbarsky [:bzbarsky]]

OK.  So I added bugzilla.mozilla.org to the noscript whitelist, then loaded the page.  It's running along, doing a bunch of reloads, and I don't see a crash.  What am I doing wrong?  What _should_ I do to reproduce?

Comment 11

[Martijn Wargers (dead)]

You need to run the testcase locally or you can check the "Work Offline" option to get the crash with the testcase.

Comment 12

[Timothy Nikkel (:tnikkel)]

I could not reproduce either testcase.

Comment 13

[Sheila Mooney]

I don't see this so I am resolving Works For Me.