Closed
Bug 404869
Opened 17 years ago
Closed 17 years ago
[FIX]Crash [@ nsXBLBinding::ResolveAllFields]
Categories
(Core :: XBL, defect, P3)
Tracking
()
VERIFIED
FIXED
People
(Reporter: jruderman, Assigned: bzbarsky)
References
Details
(Keywords: crash, testcase, Whiteboard: [sg:critical?] post 1.8-branch)
Crash Data
Attachments
(2 files)
|
(deleted),
application/vnd.mozilla.xul+xml
|
Details | |
|
(deleted),
patch
|
sicking
:
review+
sicking
:
superreview+
sicking
:
approval1.9+
|
Details | Diff | Splinter Review |
Loading the testcase causes a crash with one of the following signatures:
* Null deref, [@ nsXBLBinding::ResolveAllFields]
* Random memory deref, [@ nsXBLPrototypeBinding::ResolveAllFields]
* Random memory deref, [@ nsXBLProtoImpl::ResolveAllFields]
Flags: blocking1.9?
|
Reporter | |
Updated•17 years ago
|
Whiteboard: [sg:critical?]
|
Assignee | |
Comment 1•17 years ago
|
||
All that's needed is a field whose evaluation will flush the pending style change. Should be possible to write a testcase which doesn't have any XUL in it at all (e.g. have a field do this.ownerDocument.body.offsetHeight or whatnot).
Fix coming up.
Assignee: nobody → bzbarsky
Blocks: 372769
Summary: Crash [@ nsXBLBinding::ResolveAllFields] → [FIX]Crash [@ nsXBLBinding::ResolveAllFields]
|
|
Assignee | |
Comment 2•17 years ago
|
||
Just keep the binding alive while we execute script. The behavior will still be weird in this testcase (e.g. we'll install some fields after uninstalling the binding), but I think that's fine for this corner case.
Attachment #289742 -
Flags: superreview?(jonas)
Attachment #289742 -
Flags: review?(jonas)
|
||
Updated•17 years ago
|
Flags: blocking1.9? → blocking1.9+
Priority: -- → P3
Attachment #289742 -
Flags: superreview?(jonas)
Attachment #289742 -
Flags: superreview+
Attachment #289742 -
Flags: review?(jonas)
Attachment #289742 -
Flags: review+
Attachment #289742 -
Flags: approval1.9+
|
|
Assignee | |
Comment 3•17 years ago
|
||
Checked in. Need to land the crash test.
Opening bug up, since this is trunk-only and now fixed.
Group: security
Status: NEW → RESOLVED
Closed: 17 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
|
||
Updated•17 years ago
|
Flags: wanted1.8.1.x-
Whiteboard: [sg:critical?] → [sg:critical?] post 1.8-branch
|
||
Comment 5•17 years ago
|
||
no crash on testcase using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b3pre) Gecko/2007123104 Minefield/3.0b3pre -verified fixed
Status: RESOLVED → VERIFIED
|
||
Updated•13 years ago
|
Crash Signature: [@ nsXBLBinding::ResolveAllFields]
You need to log in
before you can comment on or make changes to this bug.
Description
•