499138 - Crash [@ nsCachedStyleData::GetStyleVisibility] with position: absolute, input type=radio and -moz-column-count

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, when hovering over the text, I usually crash.

This seems to have regressed between 2009-05-09 and 2009-05-11:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2009-05-09+05%3A00%3A00&enddate=2009-05-11+09%3A00%3A00
Regression from bug 491537 somehow?

http://crash-stats.mozilla.com/report/index/56f75fa1-f0d6-4c36-81d2-989d22090618?p=1
0  	xul.dll  	nsCachedStyleData::GetStyleVisibility  	 layout/style/nsStyleStructList.h:103
1 	xul.dll 	nsStyleContext::GetStyleVisibility 	layout/style/nsStyleStructList.h:103
2 	xul.dll 	nsFrameManager::ReResolveStyleContext 	layout/base/nsFrameManager.cpp:1110
3 	xul.dll 	nsFrameManager::ComputeStyleChangeFor 	layout/base/nsFrameManager.cpp:1490
4 	xul.dll 	nsCSSFrameConstructor::ProcessOneRestyle 	layout/base/nsCSSFrameConstructor.cpp:11307
5 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4782
6 	nspr4.dll 	_MD_CURRENT_THREAD 	nsprpub/pr/src/md/windows/w95thred.c:308
7 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:516
8 	xul.dll 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:170
9 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/src/nsAppStartup.cpp:193
10 	nspr4.dll 	PR_GetEnv 	
11 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:110
12 	firefox.exe 	firefox.exe@0x21a7 	
13 	kernel32.dll 	kernel32.dll@0x17076

Comment 1

[Boris Zbarsky [:bzbarsky]]

Possible.... I can't seem to be able to reproduce (on Mac).

Comment 2

[Boris Zbarsky [:bzbarsky]]

Martijn, can you still reproduce?  If so, does the patch in bug 505482 fix it for you?

Comment 3

[Nochum Sossonko [:Natch]]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20090722 Minefield/3.6a1pre

Still reproducible, very easily on Vista (took me ~2 seconds of playing with the mouse).

Comment 4

[Boris Zbarsky [:bzbarsky]]

That's with the patch  Or without?

I'll try to get my Windows build going again, I guess.

Comment 5

[Boris Zbarsky [:bzbarsky]]

OK, I can reproduce on Windows and the patch in bug 505482 fixes it for me.

Comment 6

[Nochum Sossonko [:Natch]]

(In reply to comment #4)
> That's with the patch  Or without?

It was without the patch. I couldn't get to the patch to try it out, sorry.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Should be fixed by checkin for bug 505482.  Not sure how to write a sane test for this.  :(

Comment 8

[Mike Beltzner [:beltzner, not reading bugmail]]

Mass change: adding fixed1.9.2 keyword

(This bug was identified as a mozilla1.9.2 blocker which was fixed before the mozilla-1.9.2 repository was branched (August 13th, 2009) as per this query: http://is.gd/2ydcb - if this bug is not actually fixed on mozilla1.9.2, please remove the keyword. Apologies for the bugspam)

Comment 9

[Aakash Desai [:aakashd]]

verified FIXED on builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a2pre)
Gecko/20090904 Namoroka/3.6a2pre ID:20090904033959

and

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.3a1pre)
Gecko/20090904 Minefield/3.7a1pre ID:20090904030702

Comment 10

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e4583668755b

Comment 11

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/e4583668755b