580685 - Crash [@ nsStyleSet::ResolveStyleFor] with computed style of outline-offset

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build.

http://crash-stats.mozilla.com/report/index/190cf665-212c-472b-a58f-694bb2100721
0  	xul.dll  	nsIContent::Tag  	 obj-firefox/dist/include/nsIContent.h:287
1 	xul.dll 	nsStyleSet::ResolveStyleFor 	layout/style/nsStyleSet.cpp:809
2 	xul.dll 	CalcLengthWith 	
3 	xul.dll 	SetCoord 	layout/style/nsRuleNode.cpp:628
4 	xul.dll 	nsRuleNode::ComputeOutlineData 	layout/style/nsRuleNode.cpp:5382
5 	xul.dll 	nsRuleNode::WalkRuleTree 	layout/style/nsStyleStructList.h:138
6 	xul.dll 	nsRuleNode::GetOutlineData 	layout/style/nsRuleNode.cpp:2029
7 	xul.dll 	nsRuleNode::GetStyleOutline 	layout/style/nsStyleStructList.h:138
8 	xul.dll 	nsStyleContext::DoGetStyleOutline 	layout/style/nsStyleStructList.h:138
9 	xul.dll 	nsStyleContext::GetStyleOutline 	layout/style/nsStyleStructList.h:138
10 	xul.dll 	nsComputedDOMStyle::GetStyleOutline 	layout/style/nsStyleStructList.h:138
11 	xul.dll 	nsComputedDOMStyle::DoGetOutlineOffset 	layout/style/nsComputedDOMStyle.cpp:2185
12 	xul.dll 	nsComputedDOMStyle::GetPropertyCSSValue 	layout/style/nsComputedDOMStyle.cpp:549
13 	xul.dll 	nsComputedDOMStyle::GetPropertyValue 	layout/style/nsComputedDOMStyle.cpp:314

Comment 1

[Boris Zbarsky [:bzbarsky]]

###!!! ASSERTION: aElement must not be null: 'aElement', file /Users/bzbarsky/mozilla/css-frameconst/mozilla/layout/style/nsStyleSet.cpp, line 789
###!!! ASSERTION: null element leaked into SelectorMatches: 'aElement', file /Users/bzbarsky/mozilla/css-frameconst/mozilla/layout/style/nsCSSRuleProcessor.cpp, line 1045

and then we die.

The issue is that there's "rem" involved, but no root element in the document, of course.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Dav

Comment 3

[Boris Zbarsky [:bzbarsky]]

Er, ignore comment 2.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 459321 [details] [diff] [review]
Fix

It might be worth testing for correct behavior (both for the case you have and the case where the style attribute also has font-size: 200px).

r=dbaron (although I'm not sure if you'd get the latter test correct -- I suppose it's not that important)

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: With the correctness test too

Requesting approval: this is effectively a null-check crash fix.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/mozilla-central/rev/0a34cbad71b4

Comment 8

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; Windows NT 6.1; rv:2.0b3pre) Gecko/20100729 Minefield/4.0b3pre