578530 - Crash in [@ nsCSSValue::UnitHasArrayValue() ]

Status: RESOLVED DUPLICATE of bug 582111

(Core :: Layout, defect)

Description

[Marcia Knous [:marcia]]

Seen while running  Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:2.0b2pre) Gecko/20100713 Minefield/4.0b2pre

STR:
1. Load the site in the URL.
2. Crash

https://crash-stats.mozilla.com/report/index/4710bfd6-ca98-41ea-b2aa-f16562100713

These crashes started on the 8th of July. The same page wfm using Firefox 3.6.6. on Win XP.

Frame  	Module  	Signature [Expand]  	Source
0 	xul.dll 	nsCSSValue::UnitHasArrayValue 	layout/style/nsCSSValue.h:242
1 	xul.dll 	SubstitutePixelValues 	layout/style/nsStyleAnimation.cpp:1991
2 	xul.dll 	nsStyleAnimation::ExtractComputedValue

Comment 1

[Marcia Knous [:marcia]]

Regarding the STR in Comment 0, sometimes it did not crash for me on load, but merely mousing over the examples triggers the crash.

Comment 2

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

(In reply to comment #0)
> These crashes started on the 8th of July.

No, they started on the 3rd of July, which was the first nightly in which this code was present (from bug 531344).

http://crash-stats.mozilla.com/report/list?product=Firefox&branch=1.9.3&branch=2.0&query_search=signature&query_type=exact&query=nsCSSValue%3A%3AUnitHasArrayValue%28%29&date=07%2F13%2F2010%2017%3A27%3A19&range_value=4&range_unit=weeks&hang_type=any&process_type=any&plugin_field=&plugin_query_type=&plugin_query=&do_query=1&admin=&signature=nsCSSValue%3A%3AUnitHasArrayValue%28%29

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I'm not seeing a crash loading the site in the URL:
http://media.smashingmagazine.com/cdn_smash/wp-content/uploads/uploader/images/css3-designs/css3-the-future-is-here/example12.html
on Linux.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Or were you saying this particular testcase started crashing on 8 July?

Comment 5

[aja+bugzilla]

I got different crash at that URL using linux32 nightly build
@ nsStyleTransformMatrix::TransformFunctionOf

http://crash-stats.mozilla.com/report/index/bp-b39da672-b5a4-4b31-8ccf-1cccd2100714

STR: Hover the links in top navigation.  
This should be the relevant html & css:

            <div id="menu">
            	<a href="index.html" id="home">HOME</a>
                <a href="aboutme.html" id="me">ABOUT ME</a>
                <a href="example12.html" id="example12">EXAMPLE 1 & 2</a>
                <a href="example3.html" id="example3">EXAMPLE 3</a>
                <a href="example4.html" id="example4">EXAMPLE 4</a>

            </div>
#menu
{
	position : absolute;
	width : 560px;
	height : 40px;
	top : 95px;
	margin-left : 380px;
}

#menu a
{
    font-size : 18px;
	float : left;
	margin-left : 20px;
	color : #7a8090;
    text-decoration : none;
    padding : 5px;
    /*background-color : rgba( 13, 15, 19, 0.44);
    -webkit-box-shadow : 3px 3px 3px #000000;*/ /* Interesting */
    
    transition : 1s;
    -moz-transition : 1s;
    -webkit-transition : 1s;
    
    border-radius : 3px;
    -moz-border-radius : 3px;
    -webkit-border-radius : 3px;
}

#menu a:hover
{
    color : white;
	-moz-transform : scaleX( 1.2 ) scaleY( 1.2 );
    -webkit-transform : scaleX( 1.2 ) scaleY( 1.2 );
    
    transition : 1s;
    -moz-transition : 1s;
    -webkit-transition : 1s;
}

Comment 6

[Marcia Knous [:marcia]]

Sorry, I mean to say the crashes started showing up in crash stats on the 8th of July.

(In reply to comment #4)
> Or were you saying this particular testcase started crashing on 8 July?

Comment 7

[Martijn Wargers (dead)]

I got this crash stack with an unminimized testcase, but after minimizing it, I got a different stack. I filed that as bug 582111.

Comment 8

[Ricardo Maçãs [:Ricmacas]]

Mozilla/5.0 (Windows; Windows NT 6.1; rv:2.0b3pre) Gecko/20100727 Minefield/4.0b3pre
Got it to crash with http://demos.hacks.mozilla.org/openweb/CSSMAKESUSICK/ after right-click -> pause video.

Comment 9

[Boris Zbarsky [:bzbarsky]]

The fix for bug 582111 should fix this bug.

Comment 10

[aja+bugzilla]

(In reply to comment #9)
> The fix for bug 582111 should fix this bug.

WFM now, (on XP): Mozilla/5.0 (Windows; Windows NT 5.1; rv:2.0b3pre) Gecko/20100731 Minefield/4.0b3pre