519341 - Crash in [@ nsFrame::BoxReflow(nsBoxLayoutState&, nsPresContext*, nsHTMLReflowMetrics&, nsIRenderingContext*, int, int, int, int, int)] when closing Firefox, morphing the * selector rule to position:absolute

Status: RESOLVED WONTFIX

(Core :: Layout: Block and Inline, defect)

Description

[Tobias (:Tobbi) Markus]

Another bug I could trigger on Firebug with a random XUL file:

1. Load a random XUL file.
2. Open Firebug. 
3. Select the * selector.
4. Add position: absolute to the * selector
5. Close Firefox.

Result: Crash in [ @nsFrame::BoxReflow(nsBoxLayoutState&, nsPresContext*, nsHTMLReflowMetrics&, nsIRenderingContext*, int, int, int, int, int)]

Crash report: http://crash-stats.mozilla.com/report/index/3650880b-cb69-42ef-94ac-7f0dd2090928?p=1

Comment 1

[Daniel Veditz [:dveditz]]

This one looks like it might be a null deref from the crash-stats report, but I haven't run it in a debugger to verify that yet.

robcee: will the Firebug fix mentioned in bug 507775 comment 18 prevent this crash as well? Even if so it seems like there's a layout problem to fix.

Comment 2

[Rob Campbell [:rc] (:robcee)]

I would think it would, yes. We'd be preventing modification to any properties in userAgent.css with that fix.

Comment 3

[Rob Campbell [:rc] (:robcee)]

this is possibly a dupe of 507775. The rule is different, but I think the net result is the same. The user modifies the rule to cause a reflow. crash ensues.

Comment 4

[Tobias (:Tobbi) Markus]

(In reply to comment #3)
> this is possibly a dupe of 507775. The rule is different, but I think the net
> result is the same. The user modifies the rule to cause a reflow. crash ensues.

Sorry to contradict, but: 
From the Firebug side, it might be the same, however, the stacks are different, which means that those are actually 2 different crashes that IMO need to be fixed.
(with different patches)

How they're triggered does not really matter, as the fix __does__ prevent the crashes from happening in Firebug, but not from happening in general.

Comment 5

[Rob Campbell [:rc] (:robcee)]

I don't mind contradiction if I'm saying something wrong. Different stacks mean different bugs.

Dan, do we have any plans for these bugs?

Comment 6

[Tobias (:Tobbi) Markus]

I'm getting the same crash when I morph the float CSS style rule in firebug to "left" for everything in the XUL namespace.

http://crash-stats.mozilla.com/report/index/bp-e0ff52a4-ed31-40e8-b15f-5347c2100523

Worth a new bug?

Is there any progress going on, currently?

Comment 7

[Mats Palmgren (inactive)]

(In reply to Tobias (:Tobbi) Markus from comment #0)
> 1. Load a random XUL file.

That's not supported by default anymore.

I don't think the STR is something we'd like to support anyway,
even if you can enable it using hidden prefs.