980223 - Emptying a tbody with a relatively positioned td crashes Firefox

Status: VERIFIED FIXED

(Core :: Layout: Tables, defect, P1)

Description

[Robin Whittleton]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140305170806

Steps to reproduce:

Booted today’s Nightly, which automatically started rendering our company jukebox. I don’t have a reduced testcase and the code isn’t public, but I can supply one if required. Hopefully it’s obvious from the crash signature and window.


Actual results:

Crash. Some signatures:
https://crash-stats.mozilla.com/report/index/3b6207be-f652-4119-94e4-535822140306
https://crash-stats.mozilla.com/report/index/393e8d94-f31d-40c0-811e-4c90a2140306



Expected results:

No boom. I definitely had a nightly from two days ago that wasn’t crashing, think I also was using yesterday’s without incident.

Comment 1

[Mats Palmgren (inactive)]

Bug 63895?

Comment 2

[Robin Whittleton]

Ah yeah, that’ll be it (the central layout is a grid of upcoming tracks and the CSS has td { position: relative; }. I don’t have time at the moment but I can make a reduced testcase later if that’s needed?

Comment 3

[Robin Whittleton]

Attachment: Testcase

OK, so here’s a reduced testcase. If you empty a <tbody> that has a relatively positioned <td> in it Firefox crashes.

Comment 4

[Alice0775 White]

bp-468d9aa7-6a60-4e9a-96ef-dc3142140306

Regression window
Good:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c75ce018e5db
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 ID:20140303193956
Crash:
https://hg.mozilla.org/integration/mozilla-inbound/rev/11ab722b0bcb
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 ID:20140303201657
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c75ce018e5db&tochange=11ab722b0bcb

Comment 6

[Seth Fowler [:seth] [:s2h]]

Taking this.

Comment 7

[Seth Fowler [:seth] [:s2h]]

(In reply to Robin Whittleton from comment #3)
> OK, so here’s a reduced testcase. If you empty a <tbody> that has a
> relatively positioned <td> in it Firefox crashes.

Thanks Robin, that's super helpful!

Comment 8

[Seth Fowler [:seth] [:s2h]]

I've fixed this problem, but since I backed out bug 63895, I decided to just update the patches there. We can consider this resolved by the backout.

Comment 9

[Benjamin Kerensa [:bkerensa]]

(In reply to Seth Fowler [:seth] from comment #8)
> I've fixed this problem, but since I backed out bug 63895, I decided to just
> update the patches there. We can consider this resolved by the backout.

I don't think this is fixed yet since its not landed on central yet... I'm hitting the same signature pretty frequently on current nightly.

Comment 10

[Benjamin Kerensa [:bkerensa]]

Tracking this for now since its a regression and topcrash will re-evaluate when fixed.

Comment 12

[Tony Chung [:tchung]]

Verified fix on 3/8 mac nightly, 30.0a1.   My crash no longer appears after updating today.

https://crash-stats.mozilla.com/report/index/1e00b804-f664-49a0-9fc5-7f10a2140308

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0

Comment 13

[Mihaela Velimiroviciu (:mihaelav)]

Does this need a test for the crashing scenario, or are the tests from bug 63895 enough?
Thanks!

Comment 14

[Seth Fowler [:seth] [:s2h]]

(In reply to Mihaela Velimiroviciu [QA] (:mihaelav) from comment #13)
> Does this need a test for the crashing scenario, or are the tests from bug
> 63895 enough?
> Thanks!

Just had a look and I don't think that the tests from bug 63895 cover this. However, the tests from bug 35168 (which recently got backed out, but I'll try to land them again this week) should cover this. So I don't think we're going to need a separate test for this bug.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/db7b7aab1524
Crashtest.

Comment 16

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/db7b7aab1524