507457 - Firefox crashes when opening certain e-mails in aol webmail. [@nsStyleSet::AddImportantRules(nsRuleNode*, nsRuleNode*)]

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Katie]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1

Whenever I open emails from the apple newsletter, and some from family, Firefox crashes. Hard. Some have images, others do not, so it does not seem to matter. It only occurs with certain e-mail addresses though.

Reproducible: Always

Steps to Reproduce:
1. Log into AOL webmail.
2. Click on emails from [e-mail] (the newsletter address) or other bad address.
3. It says "Loading" at the bottom like normal, then Firefox crashes.
Actual Results:  
Firefox closes in it's crash. Then, it says "Would you like to submit a report?" After restarting it is fine until I open another email from apple.

Expected Results:  
Firefox should have opened the email in the webmail thing and I should have been able to read it.

I'm using the default theme. The emails open fine in Safari.

Comment 1

[Matthias Versen [:Matti]]

Please read https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Comment 2

[Katie]

(In reply to comment #1)
> Please read
> https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Like this?

f62eaed8-c06d-4228-bb5b-227682090731	7/31/09	7:49 AM
99c88bb2-cca4-4ba0-8885-95c7f2090730	7/30/09	3:02 PM
4ba4abc2-0213-40b0-b143-178832090723	7/23/09	5:47 PM

Comment 3

[Matthias Versen [:Matti]]

Thank you for the crash IDs :

The top of the stack for bp-62eaed8-c06d-4228-bb5b-227682090731 :
0  	XUL  	nsStyleSet::AddImportantRules  	 r.h:305
1 	XUL 	nsStyleSet::FileRules 	layout/style/nsStyleSet.cpp:588
2 	XUL 	nsStyleSet::ResolveStyleFor 	layout/style/nsStyleSet.cpp:691
3 	XUL 	nsElementSH::PostCreate 	dom/src/base/nsDOMClassInfo.cpp:7539
4 	XUL 	XPCWrappedNative::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednative.cpp:575
5 	XUL 	XPCWrappedNative::GetNewOrUsed 	js/src/xpconnect/src/xpcwrappednative.cpp:432
6 	XUL 	XPCConvert::NativeInterface2JSObject 	js/src/xpconnect/src/xpcconvert.cpp:1146
7 	XUL 	XPCConvert::NativeData2JS 	js/src/xpconnect/src/xpcconvert.cpp:470
8 	XUL 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1595
9 	XUL 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:561
10 	XUL 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93
11 	XUL 	PrepareAndDispatch 	
12 	XUL 	nsContentPolicy::ShouldLoad 	content/base/src/nsContentPolicy.cpp:157
13 	XUL 	CSSLoaderImpl::CheckLoadAllowed 	tentPolicyUtils.h:221
14 	XUL 	CSSLoaderImpl::LoadStyleLink 	layout/style/nsCSSLoader.cpp:1809
15 	XUL 	nsStyleLinkElement::DoUpdateStyleSheet 	content/base/src/nsStyleLinkElement.cpp:313
16 	XUL 	nsStyleLinkElement::UpdateStyleSheet 	content/base/src/nsStyleLinkElement.cpp:201
17 	XUL 	HTMLContentSink::ProcessLINKTag 	content/html/document/src/nsHTMLContentSink.cpp:2943
18 	XUL 	CNavDTD::HandleDefaultStartToken 	parser/htmlparser/src/CNavDTD.cpp:1080

Comment 4

[Michael Ryan]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1

I can reproduce this. I'll try to get a testcase.

Comment 5

[Michael Ryan]

Only reproducible with Greasemonkey or certain other extensions installed. Might have something to do with the stylesheet service?

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Steps to reproduce starting from a clean profile (i.e., which extensions to install, how they need to be configured) might be helpful.

Comment 7

[Michael Ryan]

Tentative STR:
1) install Greasemonkey
2) create an AOL email account
3) send email with the following content to AOL account (I used Thunderbird's Insert->HTML... feature to do this):
<style media="only screen and (max-device-width: 0px)">*{}</style>
4) open email in AOL webmail

I'm working on a reduced extension right now to replace the Greasemonkey step.

Comment 8

[Michael Ryan]

Attachment: extension v1

Here is a somewhat reduced extension that you can use instead of Greasemonkey in the above steps. It consists of a content policy component and an install manifest.

I think this bug is the same as bug 492675 and bug 466024, which makes this top crasher #8 in the current 3.5.1 crash stats. That makes this bug a bit more exciting!

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: full crash stack

Comment 10

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: assertions to catch underlying problem

I thought we used to have these, and we still should.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: stack showing problem

I'm a bit skeptical that this is the same problem as the topcrash, which I think has been around for a while.

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

That said, I think the same assertions probably would catch the problem that is causing the topcrash.

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

This basically undoes patch 9 from bug 156716.  At the time, that fixed a bug that was causing inconsistency between the DOM screen API and media queries when I was set up with mirrored monitors.  But later the fix stopped working and I saw the relevant mochitest failures again when running with my laptop mirrored to a larger monitor.  I'm not sure if I've still been seeing them; I actually think not.  But the area is enough of a mess that given that it can cause flushes I think we're better off with that bug than this one, although I'm not even sure there's a real tradeoff.

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to comment #7)
> 3) send email with the following content to AOL account (I used Thunderbird's
> Insert->HTML... feature to do this):
> <style media="only screen and (max-device-width: 0px)">*{}</style>

Out of curiosity, did you get that snippet of HTML from the email mentioned in comment 0, or from some other source of email?



In any case, fixed on mozilla-central:
http://hg.mozilla.org/mozilla-central/rev/341662af9f31
http://hg.mozilla.org/mozilla-central/rev/d98069ba3d39

Comment 15

[Michael Ryan]

It was the email Apple sends out when you register at store.apple.com. I never figured out how to get them to send the newsletter mentioned in comment 0, but I figure they probably use the same CSS in all their emails.

Comment 16

[Samuel Sidler (old account; do not CC)]

Comment on attachment 392120 [details] [diff] [review]
assertions to catch underlying problem

Approved for 1.9.1.3. a=ss

Comment 17

[Samuel Sidler (old account; do not CC)]

Comment on attachment 392122 [details] [diff] [review]
patch

Also approved for 1.9.1.3. a=ss

Comment 18

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fixed for 1.9.1.3:
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/5608ed9651d6
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/56b47701a175

Comment 19

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I wonder if the first patch in bug 503791 helps with the underlying screen issue here.

Comment 20

[Al Billings [:abillings - ex-MoCo]]

I crafted the special e-mail in TB and used the test extension above and got the crash using Firefox 3.5.2. Verified fixed with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3pre) Gecko/20090817 Shiretoko/3.5.3pre (.NET CLR 3.5.30729).