Closed Bug 528134 Opened 10 years ago Closed 10 years ago

inDOMUtils::GetRuleNodeForContent can hand back a dead rulenode

Categories

(Core :: Layout, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla1.9.3a1
Tracking Status
status1.9.2 --- beta5-fixed
blocking1.9.1 --- .8+
status1.9.1 --- .8-fixed

People

(Reporter: bzbarsky, Assigned: bzbarsky)

References

Details

(Keywords: crash, fixed1.9.0.18, Whiteboard: [sg:critical?])

Attachments

(3 files)

Attached patch FixSplinter Review
Zack, do you prefer r=zwol, or r=zweinberg, or something else?
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Attachment #411888 - Flags: review?(zweinberg)
A bunch of tabs snuck in to that patch (making the lines look misindented).
Good catch.  Fixed locally.
Whiteboard: [sg:critical?]
Comment on attachment 411888 [details] [diff] [review]
Fix

r=dbaron

We should really get this in on 1.9.2...
Attachment #411888 - Flags: review?(zweinberg) → review+
Flags: blocking1.9.2?
Flags: blocking1.9.2? → blocking1.9.2+
Whiteboard: [sg:critical?] → [sg:critical?][needs landing][needs 192 landing]
Attachment #411888 - Flags: approval1.9.2+
http://hg.mozilla.org/mozilla-central/rev/d5a6793282b0
Whiteboard: [sg:critical?][needs landing][needs 192 landing] → [sg:critical?][needs 192 landing]
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/2707b779b74a
Whiteboard: [sg:critical?][needs 192 landing] → [sg:critical?]
Applies on 1.9.0 with -F3.
Attachment #414451 - Flags: review?(dbaron)
Comment on attachment 414451 [details] [diff] [review]
1.9.1/1.9.0 merge

r=dbaron
Attachment #414451 - Flags: review?(dbaron) → review+
These bugs landed after b4 was cut. Moving flag out.
Attachment #414451 - Flags: approval1.9.1.7?
Attachment #414451 - Flags: approval1.9.0.17?
Duplicate of this bug: 527567
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
blocking1.9.1: --- → .7+
Flags: wanted1.9.0.x+
Flags: blocking1.9.0.17+
Comment on attachment 414451 [details] [diff] [review]
1.9.1/1.9.0 merge

Approved for 1.9.1.7 and 1.9.0.17, a=dveditz for release-drivers
Attachment #414451 - Flags: approval1.9.1.7?
Attachment #414451 - Flags: approval1.9.1.7+
Attachment #414451 - Flags: approval1.9.0.17?
Attachment #414451 - Flags: approval1.9.0.17+
Duplicate of this bug: 532539
Pushed http://hg.mozilla.org/releases/mozilla-1.9.1/rev/35d5359743c3

Checked into CVS:

Checking in layout/inspector/src/inDOMUtils.cpp;
/cvsroot/mozilla/layout/inspector/src/inDOMUtils.cpp,v  <--  inDOMUtils.cpp
new revision: 1.42; previous revision: 1.41
done
Checking in layout/inspector/src/inDOMUtils.h;
/cvsroot/mozilla/layout/inspector/src/inDOMUtils.h,v  <--  inDOMUtils.h
new revision: 1.13; previous revision: 1.12
done
Checking in layout/style/nsIInspectorCSSUtils.h;
/cvsroot/mozilla/layout/style/nsIInspectorCSSUtils.h,v  <--  nsIInspectorCSSUtils.h
new revision: 1.12; previous revision: 1.11
done
Checking in layout/style/nsInspectorCSSUtils.cpp;
/cvsroot/mozilla/layout/style/nsInspectorCSSUtils.cpp,v  <--  nsInspectorCSSUtils.cpp
new revision: 1.37; previous revision: 1.36
done
Checking in layout/style/nsInspectorCSSUtils.h;
/cvsroot/mozilla/layout/style/nsInspectorCSSUtils.h,v  <--  nsInspectorCSSUtils.h
new revision: 1.13; previous revision: 1.12
David or Boris, how can QA verify this fix? For the given signature in the summary no crashes are listed at all. For which signature I would have to search?
Target Milestone: --- → mozilla1.9.3a1
(In reply to comment #16)
> See bug 527567.

I'm not able to reproduce the crash with an 3.5.7 build and the Google Page Speed addon installed. Looks like we have to wait for the beta cycle or the release to check the crash stats.
It should be hard to reproduce without frame poisoning.
Group: core-security
You need to log in before you can comment on or make changes to this bug.