Closed Bug 711651 Opened 13 years ago Closed 13 years ago

Crash after mutating DOM from MozBeforeResize event

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
All
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla11
Tracking Flags:
Tracking Status
firefox9 --- affected
firefox10 --- verified
firefox11 --- verified
firefox12 --- verified
firefox-esr10 --- unaffected
status1.9.2 --- unaffected

People

(Reporter: jruderman, Assigned: smaug)

Details

(Keywords: crash, testcase, Whiteboard: [sg:critical])

Crash Data

Attachments

(3 files)

testcase (crashes Firefox when loaded)
495 bytes, text/html
Details
stack trace
5.20 KB, text/plain
Details
patch
2.73 KB, patch
roc
: review+
christian
: approval-mozilla-aurora+
Details | Diff | Splinter Review 
Crash [@ PresShell::ResizeReflowIgnoreOverride]
Attached file stack trace — 
Assignee: nobody → bugs
OS: Mac OS X → All
Group: core-security

    
    

    
  

      
      
      
      

        Attached patch
          
          
        patch
        — 
          — Splinter Review
      

    


  
Keep things alive, and make sure rootFrame points always to a valid object.
Moving kungFuDeathGrip is enough to fix this bug, but rootFrame handling
looks extremely suspicious.

        Attachment #582431 -
        Flags: review?(roc)

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/2cff3f89e54b
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED

        Attachment #582431 -
        Flags: approval-mozilla-aurora?

    
  
Whiteboard: [sg:?]

    
  

        Attachment #582431 -
        Flags: approval-mozilla-aurora? → approval-mozilla-aurora+

    
  
Whiteboard: [sg:?] → [sg:?][qa+]

    
    

    
  
The need to add a "kungFuDeathGrip" is usually the sign of a potential sg:critical bug, marking as such.

The 1.9.2 branch is unaffected.

from comment #2
> Moving kungFuDeathGrip is enough to fix this bug, but rootFrame handling
> looks extremely suspicious.

Do we need another bug to investigate that before un-hiding this one?

          status1.9.2:
          --- → unaffected

          status-firefox12:
          --- → fixed

          status-firefox9:
          --- → affected
Whiteboard: [sg:?][qa+] → [sg:critical][qa+]
Target Milestone: --- → mozilla11
Status: RESOLVED → VERIFIED
Whiteboard: [sg:critical][qa+] → [sg:critical]
Group: core-security

          status-firefox-esr10:
          --- → unaffected
Component: DOM → DOM: Core & HTML

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: