296490 - Crash @ nsINodeInfo::GetPrefixAtom()

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bob Clary [:bc] (inactive)]

Perhaps caused by bug 235512  

nsINodeInfo::GetPrefixAtom() line 153 + 3 bytes
nsDOMAttributeMap::SetNamedItemInternal(nsIDOMNode * 0x0355c1d0, nsIDOMNode * *
0x0012d0f0, int 0x00000001) line 281 + 27 bytes
nsDOMAttributeMap::SetNamedItemNS(nsDOMAttributeMap * const 0x0360b058,
nsIDOMNode * 0x0355c1d0, nsIDOMNode * * 0x0012d0f0) line 189
nsGenericElement::SetAttributeNodeNS(nsGenericElement * const 0x03360ca8,
nsIDOMAttr * 0x0355c1d0, nsIDOMAttr * * 0x0012d298) line 1619 + 51 bytes
nsXMLElement::SetAttributeNodeNS(nsXMLElement * const 0x03360ca8, nsIDOMAttr *
0x0355c1d0, nsIDOMAttr * * 0x0012d298) line 67 + 20 bytes
XPTC_InvokeByIndex(nsISupports * 0x03360cc4, unsigned int 0x00000028, unsigned
int 0x00000002, nsXPTCVariant * 0x0012d288) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_METHOD) line 2105 + 43 bytes
XPC_WN_CallMethod(JSContext * 0x030f8230, JSObject * 0x030d2820, unsigned int
0x00000001, long * 0x039e5a74, long * 0x0012d558) line 1348 + 14 bytes
js_Invoke(JSContext * 0x030f8230, unsigned int 0x00000001, unsigned int
0x00000000) line 1178 + 23 bytes
js_Interpret(JSContext * 0x030f8230, unsigned char * 0x03b6e1f5, long *
0x0012df50) line 3468 + 15 bytes
js_Execute(JSContext * 0x030f8230, JSObject * 0x02c793c8, JSScript * 0x03b40c00,
JSStackFrame * 0x0012eb14, unsigned int 0x00000020, long * 0x0012e0d0) line 1408
+ 19 bytes
obj_eval(JSContext * 0x030f8230, JSObject * 0x030d26b0, unsigned int 0x00000001,
long * 0x039e59b8, long * 0x0012e0d0) line 1139 + 27 bytes
js_Invoke(JSContext * 0x030f8230, unsigned int 0x00000001, unsigned int
0x00000000) line 1178 + 23 bytes
js_Interpret(JSContext * 0x030f8230, unsigned char * 0x0311e1d2, long *
0x0012eb84) line 3468 + 15 bytes
js_Invoke(JSContext * 0x030f8230, unsigned int 0x00000001, unsigned int
0x00000000) line 1198 + 19 bytes
js_Interpret(JSContext * 0x030f8230, unsigned char * 0x029f51c3, long *
0x0012f52c) line 3468 + 15 bytes
js_Execute(JSContext * 0x030f8230, JSObject * 0x030d26b0, JSScript * 0x033f93d0,
JSStackFrame * 0x00000000, unsigned int 0x00000000, long * 0x0012f62c) line 1408
+ 19 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x030f8230, JSObject * 0x030d26b0,
JSPrincipals * 0x0344e1cc, const unsigned short * 0x034c0238, unsigned int
0x0000001a, const char * 0x03b7c758, unsigned int 0x0000008d, long * 0x0012f62c)
line 3793 + 25 bytes
nsJSContext::EvaluateString(const nsAString & {...}, void * 0x030d26b0,
nsIPrincipal * 0x0344e1c8, const char * 0x03b7c758, unsigned int 0x0000008d,
const char * 0x100d880c _js_default_str, nsAString * 0x00000000, int *
0x0012f6bc) line 1037 + 67 bytes
nsGlobalWindow::RunTimeout(nsTimeout * 0x03b7c6e0) line 5244 + 108 bytes
nsGlobalWindow::TimerCallback(nsITimer * 0x03b7a1c8, void * 0x03b7c6e0) line 5622
nsTimerImpl::Fire() line 394 + 17 bytes
nsTimerManager::FireNextIdleTimer(nsTimerManager * const 0x022edfe8) line 628
nsAppShell::Run(nsAppShell * const 0x02162458) line 142
nsAppStartup::Run(nsAppStartup * const 0x021623b8) line 145
XRE_main(int 0x00000003, char * * 0x01a87028, const nsXREAppData * 0x0124401c
kAppData) line 2059 + 35 bytes
main(int 0x00000003, char * * 0x01a87028) line 61 + 18 bytes
mainCRTStartup() line 338 + 17 bytes

+	mContent	0x03360ca8
-	ni	{...}
        +	mRawPtr	0x00000000
	rv	0x00000000
+	this	0x0360b058
+	value	{...}

Comment 1

[Peter Van der Beken [:peterv]]

Allen, this seems wrong:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/base/src/nsDOMAttributeMap.cpp&rev=1.47&root=/cvsroot&mark=224,237#220

Comment 2

[Allan Beaufour]

(In reply to comment #1)
> Allen, this seems wrong:
>
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/base/src/nsDOMAttributeMap.cpp&rev=1.47&root=/cvsroot&mark=224,237#220

Something's rotten yes, I'm on it.

Comment 3

[Allan Beaufour]

Attachment: Fix

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 185246 [details] [diff] [review]
Fix

a=roc for 1.8b3

Comment 5

[Allan Beaufour]

Checked in.

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed.