454736 - Crash [@ nsCachedStyleData::GetStylePadding] with XBL, MathML, XUL

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase makes Firefox crash [@ nsCachedStyleData::GetStylePadding] dereferencing 0xddddddfd.

This bug is timing-dependent in an annoying way, so I'm having trouble making a testcase suitable for automated testing.

A related testcase (not attached) triggers this assertion before crashing:

###!!! ASSERTION: Have parent context and shouldn't: 'Error', file /Users/jruderman/central/layout/base/nsFrameManager.cpp, line 835

Comment 1

[Boris Zbarsky [:bzbarsky]]

So... We have a frame pointing to a style context pointing to a destroyed rulenode.

Comment 2

[Samuel Sidler (old account; do not CC)]

Doesn't happen on Firefox 3, afaict.

Comment 3

[Lucas Adamski [:ladamski]]

I can't repro on 2.0.0.17 or 3.0.3 either.

Comment 4

[Jesse Ruderman]

I can still get trunk to crash, but I have to reload now.

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I get (on stdout or stderr):

Security Error: Content at https://bugzilla.mozilla.org/attachment.cgi?id=338044 may not load data from data:text/xml,%3Cbindings%20xmlns%3D%...


Does that security error mean I'm not getting to the stuff that crashes?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Probably, yes.  You should be able to set the "layout.debug.enable_data_xbl" to true to let that security check succeed.

Comment 7

[Boris Zbarsky [:bzbarsky]]

I meant the "layout.debug.enable_data_xbl" pref.

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Yep, crashed on the first try with that pref set to true.

Comment 9

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

(But not any additional tries, unfortunately.)

Comment 10

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

The patch in bug 475128 will likely fix this by changing the underlying problem from a crash into a correctness bug.  I didn't try to reproduce the bug again without it, though.

Comment 11

[Jesse Ruderman]

I currently get:

###!!! ABORT: style context has old rule node: 'n == mRuleTree', file /Users/jruderman/central/layout/style/nsStyleSet.cpp, line 173

Comment 12

[Jesse Ruderman]

I don't get any crashes/assertions on mozilla-central now.  I'm assuming that's thanks to the fix for bug 475128.

If there's a correctness bug remaining, can you file a new bug report on it?