282537 - crash when xbl:inherits is placed on the children tag

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[alexander :surkov (:asurkov)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a6) Gecko/20050111
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a6) Gecko/20050111

<binding id="bnd2">
<content>
	<xul:hbox>
		<children includes="button" xbl:inherits="disabled"/>
	</xul:hbox>
</content>
</binding>

<bnd2 disabled="true">
<button label="hello"/>
</bnd2>

Default namespace is http://www.mozilla.org/xbl. When I specify 'inherits'
attribute with 'xbl' prefix then mozilla is crashed.

Reproducible: Always

Steps to Reproduce:

Comment 1

[Boris Zbarsky [:bzbarsky]]

Alexander, please please attach testcases to the bug if you have them.  Don't
just paste in little snippets that have to be reverse-engineered into a testcase!

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: XBL for testcase

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase -- will crash

Simpler XBL.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: XUL for testcase -- will crash

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

The comment in the patch pretty much sums up what's going on...

The other option would be to make the attr entries hold strong refs to the
content nodes, but that seems somewhat unnecessary to me.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 174595 [details] [diff] [review]
Patch

This patch is wrong; it causes attribute inheritance to not work right for some
reason...

Comment 7

[Boris Zbarsky [:bzbarsky]]

Attachment: Better patch

Comment 8

[Boris Zbarsky [:bzbarsky]]

Attachment: Same as diff -w

Comment 9

[Boris Zbarsky [:bzbarsky]]

Fixed.