Closed Bug 478321 Opened 11 years ago Closed 10 years ago

infinite recursion crash with line-height: 1rem on root element

Categories

(Core :: CSS Parsing and Computation, defect, P2, critical)

defect

Tracking

()

RESOLVED FIXED
Tracking Status
status1.9.2 --- beta1-fixed

People

(Reporter: martijn.martijn, Assigned: dbaron)

References

Details

(Keywords: crash, regression, testcase)

Attachments

(2 files, 1 obsolete file)

Attached file testcase
See testcase, which crashes in current trunk build.
I seem to get different stacks.

http://crash-stats.mozilla.com/report/index/9ef0fb13-abcb-49c5-a5b6-089ed2090212?p=1
0  	xul.dll  	nsCSSCompressedDataBlock::MapRuleInfoInto  	 layout/style/nsCSSDataBlock.cpp:180
1 	xul.dll 	CSSStyleRuleImpl::MapRuleInfoInto 	layout/style/nsCSSStyleRule.cpp:1437
2 	xul.dll 	nsRuleNode::WalkRuleTree 	layout/style/nsRuleNode.cpp:1731
3 	xul.dll 	nsRuleNode::GetStyleFont 	layout/style/nsStyleStructList.h:73
4 	xul.dll 	CalcLengthWith 	layout/style/nsRuleNode.cpp:202
5 	xul.dll 	SetCoord 	layout/style/nsRuleNode.cpp:343
6 	xul.dll 	nsRuleNode::ComputeTextData 	layout/style/nsRuleNode.cpp:3062
7 	xul.dll 	nsRuleNode::WalkRuleTree 	layout/style/nsStyleStructList.h:89
8 	xul.dll 	nsRuleNode::GetStyleText 	layout/style/nsStyleStructList.h:89
9 	xul.dll 	nsStyleContext::GetStyleText 	layout/style/nsStyleStructList.h:89
10 		@0x2d83af7 	

http://crash-stats.mozilla.com/report/index/818a8198-33c7-4b6b-9454-405742090212?p=1
0  	xul.dll  	SelectorMatches  	 layout/style/nsCSSRuleProcessor.cpp:1213
1 	xul.dll 	ContentEnumFunc 	layout/style/nsCSSRuleProcessor.cpp:1892
2 	xul.dll 	RuleHash::EnumerateAllRules 	layout/style/nsCSSRuleProcessor.cpp:629
3 	xul.dll 	WrappedNativeProtoMarker 	
4 		@0x231f49f 	

http://crash-stats.mozilla.com/report/index/b0e3b89f-0b82-481b-a3db-87bf22090212?p=1
0  	xul.dll  	nsStyleUtil::IsLink  	 layout/style/nsStyleUtil.cpp:501
1 	xul.dll 	xul.dll@0x35bbac
This is a stack overflow; probably it's different stacks because something causes slight variation in the initial stack depth or the size of each recursive step.
Blocks: 472195
This is a stack overflow; probably it's different stacks because something causes slight variation in the initial stack depth or the size of each recursive step.
No longer blocks: 472195
Blocks: 472195
Flags: blocking1.9.2?
OS: Windows XP → All
Priority: -- → P2
Hardware: x86 → All
Summary: Crash [@ nsCSSCompressedDataBlock::MapRuleInfoInto] with line-height: 1rem → stack overflow crash with line-height: 1rem on root element
Attached patch patch (obsolete) — Splinter Review
This fixes it, although I'd like to think about it a little more and write some correctness mochitests.
Assignee: nobody → dbaron
Status: NEW → ASSIGNED
Summary: stack overflow crash with line-height: 1rem on root element → infinite recursion crash with line-height: 1rem on root element
Attached patch patchSplinter Review
Well, I don't really remember what it was I wanted to think about or test, but I wrote a few mochitests.
Attachment #362178 - Attachment is obsolete: true
Attachment #390220 - Flags: review?(bzbarsky)
Flags: blocking1.9.2? → blocking1.9.2+
Attachment #390220 - Flags: review?(bzbarsky) → review+
http://hg.mozilla.org/mozilla-central/rev/2fa18f53503b
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)
Keywords: fixed1.9.2
You need to log in before you can comment on or make changes to this bug.