Closed Bug 580685 Opened 14 years ago Closed 14 years ago

Crash [@ nsStyleSet::ResolveStyleFor] with computed style of outline-offset

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla2.0b3
Tracking Flags:
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(3 files)

testcase
(deleted), text/html
Details
Fix
(deleted), patch
dbaron
: review+
Details | Diff | Splinter Review
With the correctness test too
(deleted), patch
Details | Diff | Splinter Review
Attached file testcase (deleted) —
See testcase, which crashes current trunk build. http://crash-stats.mozilla.com/report/index/190cf665-212c-472b-a58f-694bb2100721 0 xul.dll nsIContent::Tag obj-firefox/dist/include/nsIContent.h:287 1 xul.dll nsStyleSet::ResolveStyleFor layout/style/nsStyleSet.cpp:809 2 xul.dll CalcLengthWith 3 xul.dll SetCoord layout/style/nsRuleNode.cpp:628 4 xul.dll nsRuleNode::ComputeOutlineData layout/style/nsRuleNode.cpp:5382 5 xul.dll nsRuleNode::WalkRuleTree layout/style/nsStyleStructList.h:138 6 xul.dll nsRuleNode::GetOutlineData layout/style/nsRuleNode.cpp:2029 7 xul.dll nsRuleNode::GetStyleOutline layout/style/nsStyleStructList.h:138 8 xul.dll nsStyleContext::DoGetStyleOutline layout/style/nsStyleStructList.h:138 9 xul.dll nsStyleContext::GetStyleOutline layout/style/nsStyleStructList.h:138 10 xul.dll nsComputedDOMStyle::GetStyleOutline layout/style/nsStyleStructList.h:138 11 xul.dll nsComputedDOMStyle::DoGetOutlineOffset layout/style/nsComputedDOMStyle.cpp:2185 12 xul.dll nsComputedDOMStyle::GetPropertyCSSValue layout/style/nsComputedDOMStyle.cpp:549 13 xul.dll nsComputedDOMStyle::GetPropertyValue layout/style/nsComputedDOMStyle.cpp:314
###!!! ASSERTION: aElement must not be null: 'aElement', file /Users/bzbarsky/mozilla/css-frameconst/mozilla/layout/style/nsStyleSet.cpp, line 789 ###!!! ASSERTION: null element leaked into SelectorMatches: 'aElement', file /Users/bzbarsky/mozilla/css-frameconst/mozilla/layout/style/nsCSSRuleProcessor.cpp, line 1045 and then we die. The issue is that there's "rem" involved, but no root element in the document, of course.
Component: DOM: CSS Object Model → Style System (CSS)
QA Contact: general → style-system
Dav
Blocks: 472195
blocking2.0: --- → ?
Er, ignore comment 2.
Attached patch Fix (deleted) — — Splinter Review
Attachment #459321 - Flags: review?(dbaron)
Assignee: nobody → bzbarsky
Comment on attachment 459321 [details] [diff] [review] Fix It might be worth testing for correct behavior (both for the case you have and the case where the style attribute also has font-size: 200px). r=dbaron (although I'm not sure if you'd get the latter test correct -- I suppose it's not that important)
Attachment #459321 - Flags: review?(dbaron) → review+
Attached patch With the correctness test too (deleted) — — Splinter Review
Requesting approval: this is effectively a null-check crash fix.
Attachment #459550 - Flags: approval2.0?
blocking2.0: ? → betaN+
Attachment #459550 - Flags: approval2.0?
Pushed http://hg.mozilla.org/mozilla-central/rev/0a34cbad71b4
Status: NEW → RESOLVED
Closed: 14 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b3
Verified fixed, using: Mozilla/5.0 (Windows; Windows NT 6.1; rv:2.0b3pre) Gecko/20100729 Minefield/4.0b3pre
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsStyleSet::ResolveStyleFor]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: