298725 - ASSERTION: You can't dereference a NULL nsCOMPtr with operator->()

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Bob Clary [:bc] (inactive)]

I have started to get this assertion when running the DOM TS in the last two
days. Jst came up with the patch I will attach next.

###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file ../../dist/include/xpcom\nsCOMPtr.h, line 849

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: patch

Comment 2

[Johnny Stenback (:jst)]

This is a crash regression that prevents us from getting through the DOM test
suite. Given that the patch is trivial we should IMO take this for 1.8b3.

Comment 3

[Peter Van der Beken [:peterv]]

Can you explain a) why and where it crashes and b) how this fixes it? Also why
isn't it needed for the call to CreateElem(nsHTMLAtoms::a, ...) just above?

Comment 4

[Johnny Stenback (:jst)]

a) We crash because we end up creating an XML element named 'img' in stead of an
HTML element, and we QI that to nsIImageLoadingContent and call methods on it.
The QI obviously fails, so we crash. The case we're dealing with here is an XML
document that has an XHTML object (or embed) element in it, we end up calling
doc->CreateElem(img, null, kNameSpaceID_XHTML, true), which makes use the
document's default type when creating elements (kNameSpaceID_None) when it
shouldn't use the default type at all.

And yes, we should make the exact same change to the above code that creates the
anchor tag, good catch.

Comment 5

[Peter Van der Beken [:peterv]]

Comment on attachment 187257 [details] [diff] [review]
patch

r/sr=peterv with the change to the other CreateElem call just above.

Comment 6

[Christian :Biesinger (don't email me, ping me on IRC)]

why's this a security bug?

Comment 7

[Johnny Stenback (:jst)]

Um, it's not. Must have checked the checkbox by mistake...

Comment 8

[Johnny Stenback (:jst)]

Attachment: Final patch that was checked in.

Comment 9

[Johnny Stenback (:jst)]

Fixed.