534366 - "ASSERTION: Some pres arena objects were not freed" with MathML, :first-line, :before

Status: RESOLVED FIXED

(Core :: Layout, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase 1 - ASSERTION: Some pres arena objects were not freed

###!!! ASSERTION: Some pres arena objects were not freed: 'mPresArenaAllocCount == 0', file /Users/jruderman/mozilla-central/layout/base/nsPresShell.cpp, line 1550

This assertion often indicates the presence of a security hole (which frame poisoning does not mitigate).

Comment 1

[Jesse Ruderman]

Attachment: testcase 2 - poison crash [@ nsLayoutUtils::GetNextContinuationOrSpecialSibling]

Comment 2

[Timothy Nikkel (:tnikkel)]

Caused by bug 504524.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix

Trivial fix

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 417273 [details] [diff] [review]
fix

r=dbaron

(seems like an additional piece of the fix in bug 523468)

Comment 5

[Timothy Nikkel (:tnikkel)]

This also fixes bug 525986.

Comment 6

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(In reply to comment #4)
> (seems like an additional piece of the fix in bug 523468)

Indeed.

(In reply to comment #5)
> This also fixes bug 525986.

Great!

Comment 7

[Daniel Veditz [:dveditz]]

from the patch we're using an uninitialzed irs.mLineLayout?

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

No. The constructor initializes mLineLayout to null.

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

http://hg.mozilla.org/mozilla-central/rev/56f45a084369

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I need to check this test in.

Comment 11

[Jesse Ruderman]

Crashtests: http://hg.mozilla.org/mozilla-central/rev/4a4e6dea49bd