Crash [@ nsOverflowContinuationTracker::Insert] with CSS columns

RESOLVED FIXED in mozilla22

Status

()

Core
Layout: Block and Inline
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: mats)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla22
assertion, crash, csectype-framepoisoning, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 723165 [details]
testcase (crashes Firefox when loaded)

Nightly:
Null deref [@ nsOverflowContinuationTracker::Insert]
bp-2c5476fa-1e72-4ff1-8521-b90672130310

ASan:
Use-after-poison [@ nsOverflowContinuationTracker::Insert]

Debug:
Assertion failure: !aFrame->GetPrevSibling() || !aFrame->GetNextSibling() (Forgot to call StartRemoveFrame?), at layout/generic/nsIFrame.h:3267
(Reporter)

Comment 1

5 years ago
Created attachment 723166 [details]
stack for assert

Comment 2

5 years ago
On Windows: bp-23ec460d-ce6a-40dc-811e-8ebd72130310.
Crash Signature: [@ nsOverflowContinuationTracker::StepForward() ] [@ nsOverflowContinuationTracker::Insert(nsIFrame*, unsigned int&) ]
OS: Mac OS X → All
Hardware: x86_64 → All
(Assignee)

Updated

5 years ago
Assignee: nobody → matspal
Component: DOM → Layout: Block and Inline
Keywords: testcase
(Assignee)

Comment 3

5 years ago
Created attachment 725210 [details] [diff] [review]
fix+test

There's a logic error in the way I wrote the TryRemoveFrame helper for
StealFrame.  If the first list (OverflowContainers) does not exist then
there will be no call to StartRemoveFrame, but for the second list
(ExcessOverflowContainers) we'll use ContinueRemoveFrame unconditionally
but that *requires* a prior call to StartRemoveFrame.

For now, it's simpler to just use StartRemoveFrame for both calls; the
ContinueRemoveFrame optimization isn't worth it in this case.

(I'll try to simplify this code further in an upcoming patch, after some
other changes I have in my queue.)

https://tbpl.mozilla.org/?tree=Try&rev=c465ec67befb
Attachment #725210 - Flags: review?(bzbarsky)
Comment on attachment 725210 [details] [diff] [review]
fix+test

r=me
Attachment #725210 - Flags: review?(bzbarsky) → review+
https://hg.mozilla.org/mozilla-central/rev/fb7e2b6eef1b
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in before you can comment on or make changes to this bug.