690990 - "ABORT: should not get marked modified during parsing"

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

###!!! ABORT: should not get marked modified during parsing: '!data->mSheet->IsModified()', file layout/style/Loader.cpp, line 1748

Could this be a regression from bug 185236?

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Boris Zbarsky [:bzbarsky]]

Yes.  The bug is in the assertion itself, though.

The issue is that the appendChild call in this case will go ahead and create a new stylesheet which is all set to go.  It will also post an async SheetComplete for it.  Then the very next line of script will modify the sheet.

The assertion just needs to move into the !mSheetAlreadyComplete block.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Don't assert that sheets are not modified when it would be just fine for them to be modified.

Comment 4

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f5aa42137fbc

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 564116 [details] [diff] [review]
Don't assert that sheets are not modified when it would be just fine for them to be modified.

I believe we should take this on aurora.  It's a very safe change (debug-only code moving around), and will keep this bug from getting in the way of Jesse's fuzzers.

Comment 6

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/f5aa42137fbc

Comment 7

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/625b0a5109eb

Comment 8

[Vlad [QA]]

Hi guys.
In order to verify this bug, it's enough if I load the test case from the attachments and observe that Firefox isn't crashing?
Thanks

Comment 9

[Boris Zbarsky [:bzbarsky]]

In a debug build, yes.

Comment 10

[Vlad [QA]]

Setting resolution to Verified Fixed on debug builds:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0) Gecko/20111201 Firefox/9.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:10.0a2) Gecko/20111202 Firefox/10.0a2
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0a1) Gecko/20111205 Firefox/11.0a1

Based on comment8 and comment9, I have loaded the test case from the description and Firefox did not crash.