Last Comment Bug 475136 - Crash [@ nsCSSStyleSheet::GetOwnerNode] after GC
: Crash [@ nsCSSStyleSheet::GetOwnerNode] after GC
Status: RESOLVED FIXED
[sg:critical]
: crash, fixed1.8.1.21, fixed1.9.1, testcase, verified1.9.0.7
Product: Core
Classification: Components
Component: CSS Parsing and Computation (show other bugs)
: Trunk
: All All
: P3 critical (vote)
: mozilla1.9.1b3
Assigned To: David Baron :dbaron: ⌚️UTC-7 (busy September 14-25)
:
Mentors:
Depends on:
Blocks: 326633 randomclasses
  Show dependency treegraph
 
Reported: 2009-01-23 22:23 PST by Jesse Ruderman
Modified: 2011-06-13 10:01 PDT (History)
9 users (show)
roc: blocking1.9.1-
roc: wanted1.9.1+
dveditz: wanted1.9.0.x+
dveditz: blocking1.8.1.next+
dveditz: wanted1.8.1.x+
asac: blocking1.8.0.next+
dbaron: in‑testsuite?
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (crashes Firefox when loaded, if Quitter is installed) (544 bytes, text/html)
2009-01-23 22:23 PST, Jesse Ruderman
no flags Details
valgrind's explanation of crash (3.89 KB, text/plain; charset=UTF-8)
2009-01-23 23:12 PST, David Baron :dbaron: ⌚️UTC-7 (busy September 14-25)
no flags Details
patch (6.42 KB, patch)
2009-01-23 23:38 PST, David Baron :dbaron: ⌚️UTC-7 (busy September 14-25)
no flags Details | Diff | Splinter Review
patch (6.48 KB, patch)
2009-01-23 23:41 PST, David Baron :dbaron: ⌚️UTC-7 (busy September 14-25)
bzbarsky: review+
bzbarsky: superreview+
roc: approval1.9.1+
dveditz: approval1.9.0.7+
Details | Diff | Splinter Review
1.8 version (4.11 KB, patch)
2009-02-19 05:30 PST, Martin Stránský
dveditz: approval1.8.1.next+
asac: approval1.8.0.next+
Details | Diff | Splinter Review

Description Jesse Ruderman 2009-01-23 22:23:24 PST
Created attachment 358552 [details]
testcase (crashes Firefox when loaded, if Quitter is installed)

Loading the testcase causes nsCSSStyleSheet::GetOwnerNode to call some random address.

The testcase assumes you have http://www.squarefree.com/extensions/quitter.xpi installed, and uses it to trigger a GC at the right moment.
Comment 1 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-01-23 23:12:43 PST
Created attachment 358557 [details]
valgrind's explanation of crash

Not as helpful as I was hoping.
Comment 2 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-01-23 23:38:17 PST
Created attachment 358561 [details] [diff] [review]
patch

Thoughts on this approach vs. a DropStyleSheet method that just does the setting to null (and would also be called by SetStyleSheet)?
Comment 3 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-01-23 23:41:17 PST
Created attachment 358562 [details] [diff] [review]
patch

Oops, forgot to qrefresh after my last edit.
Comment 4 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-01-24 00:27:42 PST
And to be clear:  what's fixing the bug is that we're now calling SetOwningNode(nsnull) at the two places in nsStyleLinkElement::DoUpdateStyleSheet that used to just do mStyleSheet = nsnull.
Comment 5 Boris Zbarsky [:bz] (TPAC) 2009-01-25 17:31:16 PST
Comment on attachment 358562 [details] [diff] [review]
patch

Good catch.  Can we possibly write a mochitest for this?
Comment 6 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-01-29 15:48:23 PST
http://hg.mozilla.org/mozilla-central/rev/014fe552d77a
Comment 7 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-01-31 12:58:00 PST
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/94fded227f9e
Comment 8 Daniel Veditz [:dveditz] 2009-02-02 14:53:28 PST
Comment on attachment 358562 [details] [diff] [review]
patch

Approved for 1.9.0.7, a=dveditz for release-drivers.
Comment 9 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-02-02 20:19:47 PST
Commited to CVS trunk (for 1.9.0.* releases), 2009-02-02 20:13 -0800.
Comment 10 Daniel Veditz [:dveditz] 2009-02-12 12:03:19 PST
dbaron: Is this needed for the 1.8 branch? The testcase doesn't crash because Quitter fails to GC (Components.utils.forceGC is not a function), but the 1.8 version of nsStyleLinkElement::UpdateStyleSheet has code identical to that which you patched.
Comment 11 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-02-12 12:30:29 PST
I don't know any reason that it wouldn't be needed... so it's probably needed.
Comment 12 Al Billings [:abillings] 2009-02-12 16:31:22 PST
Verified that the testcase here crashes 1.9.0.6 but doesn't crash 1.9.0.7 (with quitter extension). Used Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.7pre) Gecko/2009021204 GranParadiso/3.0.7pre.
Comment 13 Martin Stránský 2009-02-19 05:30:14 PST
Created attachment 363095 [details] [diff] [review]
1.8 version
Comment 14 Samuel Sidler (old account; do not CC) 2009-02-19 09:57:38 PST
Comment on attachment 363095 [details] [diff] [review]
1.8 version

>--- mozilla/content/base/src/nsStyleLinkElement.h.475136	2004-09-09 19:32:34.000000000 +0200
>+++ mozilla/content/base/src/nsStyleLinkElement.h	2009-02-17 18:12:08.000000000 +0100
>@@ -72,6 +72,7 @@ public:
> 
>   static void ParseLinkTypes(const nsAString& aTypes, nsStringArray& aResult);
> 
>+
> protected:
>   virtual void GetStyleSheetURL(PRBool* aIsInline,
>                                 nsIURI** aURI) = 0;

What's this added whitespace for?

Otherwise than that nit, this is probably good for checkin.
Comment 15 Daniel Veditz [:dveditz] 2009-02-20 11:20:21 PST
Comment on attachment 363095 [details] [diff] [review]
1.8 version

Approved for 1.8.1.21, a=dveditz for release-drivers

In the future please use the same diff options as the patch you're porting (context lines, etc). that makes comparing them much easier
Comment 16 David Baron :dbaron: ⌚️UTC-7 (busy September 14-25) 2009-02-23 09:58:44 PST
Committed the backported patch to MOZILLA_1_8_BRANCH, 2009-02-23 09:57 -0800.  Thanks for doing the backport.
Comment 17 Alexander Sack 2009-03-05 03:11:44 PST
Comment on attachment 363095 [details] [diff] [review]
1.8 version

a=asac for 1.8.0

Note You need to log in before you can comment on or make changes to this bug.