Crash when resizing window and changing CSS width

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
6 years ago
6 years ago

People

(Reporter: jruderman, Assigned: jwatt)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

17 Branch
mozilla17
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(firefox17-)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 644785 [details]
testcase (must be a popup)
(Reporter)

Comment 1

6 years ago
Created attachment 644787 [details]
opens the testcase as a popup
(Reporter)

Comment 2

6 years ago
Created attachment 644788 [details]
stack trace
(Reporter)

Comment 3

6 years ago
bp-748d4597-38b1-494b-8a5c-9c37f2120722
Crash Signature: [@ DoApplyRenderingChangeToTree ]

Comment 4

6 years ago
Browser crashes with  attachment 644785 [details] in Wndows7
bp-49dc6050-9490-4c37-8c2f-1a98f2120722

Regression window(m-c)
Not crash:
http://hg.mozilla.org/mozilla-central/rev/6dae57cd2f85
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720145842
Crash:
http://hg.mozilla.org/mozilla-central/rev/045c11dd41a6
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720205642
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6dae57cd2f85&tochange=045c11dd41a6


Regression window(m-i)
Not crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/a746aaa32b22
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720114508
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/62f19ed60528
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720115241
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a746aaa32b22&tochange=62f19ed60528
We crash because in the "if (aChange & nsChangeHint_ChildrenOnlyTransform)" block in DoApplyRenderingChangeToTree we have this code:

  nsIFrame *f = aFrame->GetContent()->GetPrimaryFrame();

but aFrame->GetContent() is null, because aFrame is the viewport.  So we crash on the null-deref.

If we didn't crash here, I bet we'd fail the following assert:

7737          NS_ABORT_IF_FALSE(f->IsFrameOfType(nsIFrame::eSVG |
7738                                             nsIFrame::eSVGContainer),
7739                            "Children-only transforms only expected on SVG frames");

This looks like code added in bug 614732.

The reason we have a viewport here is that we initially pass the nsSVGOuterSVGFrame to ApplyRenderingChangeToTree, but then the code in there does this:

  // If the frame's background is propagated to an ancestor, walk up to
  // that ancestor.

and in this case this is a root <svg>, so its background _is_ propagated to an ancestor as far as that code is concerned (like for any root element) and we walk up to the viewport...
Blocks: 614732
tracking-firefox17: --- → ?
Keywords: regression

Comment 6

6 years ago
On Windows: bp-ed218940-156d-4a52-871d-03a8d2120723.
Crash Signature: [@ DoApplyRenderingChangeToTree ] → [@ DoApplyRenderingChangeToTree ] [@ nsIContent::GetPrimaryFrame()]
OS: Mac OS X → All
Hardware: x86_64 → All
Version: Trunk → 17 Branch
tracking-firefox17: ? → +
(Assignee)

Comment 8

6 years ago
(In reply to Boris Zbarsky (:bz) from comment #5)
> We crash because in the "if (aChange & nsChangeHint_ChildrenOnlyTransform)"
> block in DoApplyRenderingChangeToTree we have [...]

I don't see how the testcase can cause us to get into that block (it doesn't seem to in current tip builds), since it doesn't change any children-only transforms.

Comment 9

6 years ago
I cannot reproduce the crash with attachment 644785 [details].

Fixed window(m-c):
Crash:
http://hg.mozilla.org/mozilla-central/rev/3613cbdc3481
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723144443
Fixed:
http://hg.mozilla.org/mozilla-central/rev/a26e751bfb54
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120724071408
Fixed range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3613cbdc3481&tochange=a26e751bfb54

Fixed window(m-i):
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4c9ee7535383
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723085942
Fixed:
http://hg.mozilla.org/integration/mozilla-inbound/rev/fd7d6cfafe09
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723091342
Fixed range:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4c9ee7535383&tochange=fd7d6cfafe09

Updated

6 years ago
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME

Updated

6 years ago
tracking-firefox17: + → -
(Assignee)

Updated

6 years ago
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.