238005 - [FIXr]Crash on HTMLSelectElement.add when before param is option in different select element

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[carnold]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

DOM L2 HTML specifies that a NOT_FOUND_ERR should be thrown if the before param
is an OPTION but not part of the target SELECT on a call to
HTMLSelectElement.add.  This previously mentioned page is a stripped down
version of W3C DOM L2 HTML test HTMLSelectElement20 which tests that. 
Unfortunately, there does not appear to be any guard in the Mozilla code base
that checks that and getting through results in a crash.

Reproducible: Always
Steps to Reproduce:
1. Open to http://home.houston.rr.com/curta/select_crash.html
2. Press OK on Starting test alert


Actual Results:  
Stall and eventual crash

Expected Results:  
Displayed a "Test Succeeded" alert.

There would have been a Talkback on 18 Mar 2004 from me that would have been my
initial observation of the problem.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Actually, we have a check. It's just wrong.

Note that I can't reproduce the bug with a current Linux, myself, but I'm
betting this will fix it for anyone who can.... (the bug depends on the order
some instructions get compiled in).

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

caillon, peterv, would you review?

Comment 3

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

It would be nice if we could force |x->foo(getter_addRefs(x))| to not
compile...

Comment 4

[Peter Van der Beken [:peterv]]

Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

I suppose we could integrate the |if (!parent)| into the while loop, but sure.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

Could this be approved for 1.7final?  Very safe change to not misuse
nsCOMPtr...

Comment 6

[Asa Dotzler [:asa]]

Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

a=asa (on behalf of drivers) for checkin to 1.7

Comment 7

[Boris Zbarsky [:bzbarsky]]

Fxied for 1.7