"ASSERTION: Some pres arena objects were not freed" with MathML, :first-line, :before

RESOLVED FIXED

Status

()

Core
Layout
P1
critical
RESOLVED FIXED
8 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: roc)

Tracking

(Blocks: 2 bugs, 4 keywords)

Trunk
x86
Mac OS X
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(blocking2.0 alpha1+, status1.9.2 unaffected, status1.9.1 unaffected)

Details

(Whiteboard: [sg:investigate])

Attachments

(3 attachments)

(Reporter)

Description

8 years ago
Created attachment 417225 [details]
testcase 1 - ASSERTION: Some pres arena objects were not freed

###!!! ASSERTION: Some pres arena objects were not freed: 'mPresArenaAllocCount == 0', file /Users/jruderman/mozilla-central/layout/base/nsPresShell.cpp, line 1550

This assertion often indicates the presence of a security hole (which frame poisoning does not mitigate).
(Reporter)

Comment 1

8 years ago
Created attachment 417226 [details]
testcase 2 - poison crash [@ nsLayoutUtils::GetNextContinuationOrSpecialSibling]
Caused by bug 504524.
Blocks: 504524
Assignee: nobody → roc
blocking2.0: --- → ?
Created attachment 417273 [details] [diff] [review]
fix

Trivial fix
Attachment #417273 - Flags: review?(dbaron)
Blocks: 523468
Comment on attachment 417273 [details] [diff] [review]
fix

r=dbaron

(seems like an additional piece of the fix in bug 523468)
Attachment #417273 - Flags: review?(dbaron) → review+
This also fixes bug 525986.
(In reply to comment #4)
> (seems like an additional piece of the fix in bug 523468)

Indeed.

(In reply to comment #5)
> This also fixes bug 525986.

Great!
Blocks: 525986
Whiteboard: [needs landing]
from the patch we're using an uninitialzed irs.mLineLayout?
status1.9.1: --- → unaffected
status1.9.2: --- → unaffected
Keywords: regression
Whiteboard: [needs landing] → [needs landing][sg:investigate]
No. The constructor initializes mLineLayout to null.
http://hg.mozilla.org/mozilla-central/rev/56f45a084369
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
Whiteboard: [needs landing][sg:investigate] → [sg:investigate]
I need to check this test in.
Flags: in-testsuite?
Whiteboard: [sg:investigate] → [sg:investigate][needs landing]
blocking2.0: ? → alpha1
Priority: -- → P1
Group: core-security
(Reporter)

Comment 11

7 years ago
Crashtests: http://hg.mozilla.org/mozilla-central/rev/4a4e6dea49bd
Flags: in-testsuite? → in-testsuite+
Whiteboard: [sg:investigate][needs landing] → [sg:investigate]
You need to log in before you can comment on or make changes to this bug.