334105 - [FIX]ASSERTION: Bogus: '!mHead' (nsLineBox.cpp#916 - nsFloatCacheFreeList::Append)

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Jesse Ruderman]

###!!! ASSERTION: Bogus: '!mHead', file mozilla/layout/generic/nsLineBox.cpp, line 916

Marking security-sensitive for now because when I asked dbaron about this assertion failure, he said it "may be a sign of existing memory corruption".

Comment 1

[Jesse Ruderman]

Attachment: testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

We probably want this on the 1.8.1 branch, since we can leak the float cache entries off the free list without it...

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 218617 [details] [diff] [review]
Fix

That's what we get for using wacky representations of circularly linked lists, I suppose.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 218617 [details] [diff] [review]
Fix

If this is really a potential security problem should this be nominated for 1.8.0.3 as well?

Comment 6

[Boris Zbarsky [:bzbarsky]]

I think this is just a leak, not a security problem...  At least as far as I can see.  There's no memory corruption, just a bad algorithm for messing with the linked list that manages to lose parts of the list.

Comment 7

[Jesse Ruderman]

Thanks, bz.  Making public.

Comment 8

[Jesse Ruderman]

Crashtest checked in.