776393 - Crash when resizing window and changing CSS width

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (must be a popup)

Comment 1

[Jesse Ruderman]

Attachment: opens the testcase as a popup

Comment 2

[Jesse Ruderman]

Attachment: stack trace

Comment 3

[Jesse Ruderman]

bp-748d4597-38b1-494b-8a5c-9c37f2120722

Comment 4

[Alice0775 White]

Browser crashes with  attachment 644785 [details] in Wndows7
bp-49dc6050-9490-4c37-8c2f-1a98f2120722

Regression window(m-c)
Not crash:
http://hg.mozilla.org/mozilla-central/rev/6dae57cd2f85
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720145842
Crash:
http://hg.mozilla.org/mozilla-central/rev/045c11dd41a6
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720205642
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6dae57cd2f85&tochange=045c11dd41a6


Regression window(m-i)
Not crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/a746aaa32b22
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720114508
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/62f19ed60528
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120720115241
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a746aaa32b22&tochange=62f19ed60528

Comment 5

[Boris Zbarsky [:bzbarsky]]

We crash because in the "if (aChange & nsChangeHint_ChildrenOnlyTransform)" block in DoApplyRenderingChangeToTree we have this code:

  nsIFrame *f = aFrame->GetContent()->GetPrimaryFrame();

but aFrame->GetContent() is null, because aFrame is the viewport.  So we crash on the null-deref.

If we didn't crash here, I bet we'd fail the following assert:

7737          NS_ABORT_IF_FALSE(f->IsFrameOfType(nsIFrame::eSVG |
7738                                             nsIFrame::eSVGContainer),
7739                            "Children-only transforms only expected on SVG frames");

This looks like code added in bug 614732.

The reason we have a viewport here is that we initially pass the nsSVGOuterSVGFrame to ApplyRenderingChangeToTree, but then the code in there does this:

  // If the frame's background is propagated to an ancestor, walk up to
  // that ancestor.

and in this case this is a root <svg>, so its background _is_ propagated to an ancestor as far as that code is concerned (like for any root element) and we walk up to the viewport...

Comment 6

[Scoobidiver (away)]

On Windows: bp-ed218940-156d-4a52-871d-03a8d2120723.

Comment 7

[Jonathan Watt [:jwatt]]

This crash appears to have gone between the following two Mac builds:

https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/07/2012-07-24-03-05-51-mozilla-central/
https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2012/07/2012-07-24-07-14-08-mozilla-central/

Which would give an anti-regression range of:

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3613cbdc3481&tochange=a26e751bfb54

Comment 8

[Jonathan Watt [:jwatt]]

(In reply to Boris Zbarsky (:bz) from comment #5)
> We crash because in the "if (aChange & nsChangeHint_ChildrenOnlyTransform)"
> block in DoApplyRenderingChangeToTree we have [...]

I don't see how the testcase can cause us to get into that block (it doesn't seem to in current tip builds), since it doesn't change any children-only transforms.

Comment 9

[Alice0775 White]

I cannot reproduce the crash with attachment 644785 [details].

Fixed window(m-c):
Crash:
http://hg.mozilla.org/mozilla-central/rev/3613cbdc3481
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723144443
Fixed:
http://hg.mozilla.org/mozilla-central/rev/a26e751bfb54
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120724071408
Fixed range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3613cbdc3481&tochange=a26e751bfb54

Fixed window(m-i):
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4c9ee7535383
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723085942
Fixed:
http://hg.mozilla.org/integration/mozilla-inbound/rev/fd7d6cfafe09
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723091342
Fixed range:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4c9ee7535383&tochange=fd7d6cfafe09