475215 - Crash due to too much recursion in nsCSSSelector::ToStringInternal

Status: VERIFIED FIXED

(Core :: DOM: CSS Object Model, defect, P4)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox with ulimit -s 200)

498   // selectors are linked from right-to-left, so the next selector in the linked list
499   // actually precedes this one in the resulting string

:(

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch 1: tests for what I'm going to change, and a crash fix for those tests

This adds a bunch of tests that I wanted to be sure not to break, and fixes a crash in those tests, which was a null dereference of prefixAtom just below the lines inserted, after failing this assertion:

       NS_ASSERTION(prefixAtom, "how'd we get a non-default namespace "
                    "without a prefix?");
       nsAutoString prefix;
       prefixAtom->ToString(prefix);

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch 2: do serialization without recursion

This should fix the bug, although I admit I was too lazy to test...

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 361897 [details] [diff] [review]
patch 1: tests for what I'm going to change, and a crash fix for those tests

Hrm.  I'd thought I'd checked that...  Do we need to backport this part to 1.9.1?

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

http://hg.mozilla.org/mozilla-central/rev/044096199dd6
http://hg.mozilla.org/mozilla-central/rev/cb9390d48d10

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/bd55ea224fb7

marking fixed1.9.1 since the part I wanted to land on 1.9.1 is fixed there.

Comment 6

[Aakash Desai [:aakashd]]

verified FIXED on builds: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090415 Minefield/3.6a1pre ID:20090415030845

and

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4pre) Gecko/20090416 Shiretoko/3.5b4pre ID:20090416030924

I'm a bit confused on the test cases for patch 1, were they added to in-testsuite? I'll raise the flag for a check.

Comment 7

[Carsten Book [:Tomcat]]

testcase crash Firefox 3.0.14 on load -> http://crash-stats.mozilla.com/report/index/dc57eee0-f06c-48a2-ad42-2e7852090915?p=1