Last Comment Bug 534366 - "ASSERTION: Some pres arena objects were not freed" with MathML, :first-line, :before
: "ASSERTION: Some pres arena objects were not freed" with MathML, :first-line,...
Status: RESOLVED FIXED
[sg:investigate]
: assertion, crash, regression, testcase
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: x86 Mac OS X
: P1 critical (vote)
: ---
Assigned To: Robert O'Callahan (:roc) (email my personal email if necessary)
:
: Jet Villegas (:jet)
Mentors:
Depends on:
Blocks: randomclasses 347580 framedest 504524 523468 525986
  Show dependency treegraph
 
Reported: 2009-12-11 20:12 PST by Jesse Ruderman
Modified: 2011-03-31 19:46 PDT (History)
5 users (show)
jruderman: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
alpha1+
unaffected
unaffected


Attachments
testcase 1 - ASSERTION: Some pres arena objects were not freed (1014 bytes, text/html)
2009-12-11 20:12 PST, Jesse Ruderman
no flags Details
testcase 2 - poison crash [@ nsLayoutUtils::GetNextContinuationOrSpecialSibling] (1.07 KB, text/html)
2009-12-11 20:13 PST, Jesse Ruderman
no flags Details
fix (789 bytes, patch)
2009-12-12 11:21 PST, Robert O'Callahan (:roc) (email my personal email if necessary)
dbaron: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2009-12-11 20:12:55 PST
Created attachment 417225 [details]
testcase 1 - ASSERTION: Some pres arena objects were not freed

###!!! ASSERTION: Some pres arena objects were not freed: 'mPresArenaAllocCount == 0', file /Users/jruderman/mozilla-central/layout/base/nsPresShell.cpp, line 1550

This assertion often indicates the presence of a security hole (which frame poisoning does not mitigate).
Comment 1 Jesse Ruderman 2009-12-11 20:13:47 PST
Created attachment 417226 [details]
testcase 2 - poison crash [@ nsLayoutUtils::GetNextContinuationOrSpecialSibling]
Comment 2 Timothy Nikkel (:tnikkel) 2009-12-12 01:49:09 PST
Caused by bug 504524.
Comment 3 Robert O'Callahan (:roc) (email my personal email if necessary) 2009-12-12 11:21:32 PST
Created attachment 417273 [details] [diff] [review]
fix

Trivial fix
Comment 4 David Baron :dbaron: ⌚️UTC-10 (vacation, returning December 19) 2009-12-12 16:09:37 PST
Comment on attachment 417273 [details] [diff] [review]
fix

r=dbaron

(seems like an additional piece of the fix in bug 523468)
Comment 5 Timothy Nikkel (:tnikkel) 2009-12-13 01:40:50 PST
This also fixes bug 525986.
Comment 6 Robert O'Callahan (:roc) (email my personal email if necessary) 2009-12-13 16:11:17 PST
(In reply to comment #4)
> (seems like an additional piece of the fix in bug 523468)

Indeed.

(In reply to comment #5)
> This also fixes bug 525986.

Great!
Comment 7 Daniel Veditz [:dveditz] 2009-12-13 20:10:42 PST
from the patch we're using an uninitialzed irs.mLineLayout?
Comment 8 Robert O'Callahan (:roc) (email my personal email if necessary) 2009-12-13 20:30:15 PST
No. The constructor initializes mLineLayout to null.
Comment 9 Robert O'Callahan (:roc) (email my personal email if necessary) 2009-12-15 14:13:13 PST
http://hg.mozilla.org/mozilla-central/rev/56f45a084369
Comment 10 Robert O'Callahan (:roc) (email my personal email if necessary) 2009-12-15 14:16:58 PST
I need to check this test in.
Comment 11 Jesse Ruderman 2010-05-29 21:59:22 PDT
Crashtests: http://hg.mozilla.org/mozilla-central/rev/4a4e6dea49bd

Note You need to log in before you can comment on or make changes to this bug.