460924 - Crash [@ nsStyleContext::FindChildWithRules] [@ nsFrame::CorrectStyleParentFrame] with -moz-column, :first-line

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase makes Firefox crash with one of the following signatures:

* [@ nsFrame::CorrectStyleParentFrame] - null deref 
* [@ nsStyleContext::FindChildWithRules] - 0xdddddde1 deref

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: backtrace of Linux crash in nsFrame::CorrectStyleParentFrame

I can reproduce this crash on an up-to-date mozilla-central Linux debug build.  Here's the backtrace of the crash (under "CorrectStyleParentFrame").

Briefly investigating in GDB shows that at line 5826 in CorrectStyleParentFrame, we end up with "parent" pointing to a bogus nsIFrame (with almost all of its member data zeroed out).  So, the call to parent->GetStyleContext()->GetPseudoType() dies.
MXR reference: http://tinyurl.com/5nauon

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This works for me on:
  * today's 32-bit Linux mozilla-1.9.1 nightly, and
  * my 64-bit Linux debug build with my patch queue.

Comment 3

[Jesse Ruderman]

WFM.