Loading the testcase triggers a crash. It appears exploitable. The crash only happens if the mutation event listener is on |window|. If it's on |document|, there is no crash. The mutation event listener does not appear to be called, but it has to be installed in order to trigger the bug. Sometimes, this assertion shows up before the crash: ###!!! ASSERTION: tearoff not empty in dtor: '!(GetInterface()||GetNative()||GetJSObject())', file /Users/jruderman/trunk/mozilla/js/src/xpconnect/src/xpcinlines.h, line 662

Oops, attached the wrong thing in comment 0.

The nsXMLProcessingInstruction constructor calls SetData(): http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/content/xml/content/src/nsXMLProcessingInstruction.cpp&rev=1.77&root=/cvsroot&mark=84#78 which calls SetTextInternal() with aNotify=PR_TRUE but since we do this from the constructor there is no strong ref yet so when the nsMutationEvent object is destroyed when we leave the scope here http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/content/base/src/nsGenericDOMDataNode.cpp&rev=3.250&root=/cvsroot&mark=486#440 'this' is deleted. The first stack shows the call to free(), the second the crash stack.

Don't notify when setting the value from within the ctor. (and mute a warning)

Alternative patch that still uses SetData() that notifies, but doing it in a separate step after we have NS_ADDREF'ed the object.

On the 1.8 branch I don't crash, I just get WARNING: waaah!, file c:/dev/ff2/mozilla/content/xul/document/src/nsXULPrototypeDocument.cpp, line 862

I sort of want to do both patch versions. I see no reason to notify as there can't be anything yet that listens to the notification. But it's in general a nice code cleanup to not have the "clonetext" argument. Though now isn't really the time for cleanups, so maybe we should just take the rev 1 patch for now and land the other once we've branched for FF3.

This patch is ready to be landed, right?

Patch rev.1 + crashtest landed: mozilla/content/base/src/nsCommentNode.cpp 3.89 mozilla/content/xml/content/src/nsXMLProcessingInstruction.cpp 1.78 mozilla/content/xml/content/crashtest/420429.xul 1.1 mozilla/content/xml/content/crashtest/crashtests.list 1.1 mozilla/testing/crashtest/crashtests.list 1.32 Filed bug 421034 on the parameter cleanup. -> FIXED

verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b5pre) Gecko/2008031704 Minefield/3.0b5pre as well as the Win XP nighty. No crash using the testcase.