326998 - [FIX]Crash [@ nsBoxFrame::AttributeChanged] when changing ordinal value of a xul element in html

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[Martijn Wargers (dead)]

See upcoming testcase, which crashes current trunk Mozilla build. It also crashes Mozilla1.7.12.


Talkback ID: TB15086320X

nsBoxFrame::AttributeChanged  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1314]
nsCSSFrameConstructor::AttributeChanged  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 10802]
PresShell::AttributeChanged  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 5140]
nsGenericElement::SetAttrAndNotify  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 3759]
nsGenericElement::SetAttr  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsGenericElement.cpp, line 3676]
nsXULElement::SetOrdinal  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2291]
XPCWrappedNative::CallMethod  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2152]
XPC_WN_GetterSetter  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1468]
js_Invoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1243]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1344]
js_InternalGetOrSet  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1403]
js_SetProperty  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 3125]
js_Interpret  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3655]
js_Invoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1267]
js_InternalInvoke  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1344]
JS_CallFunctionValue  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4176]
nsJSContext::CallEventHandler  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1424]
nsGlobalWindow::RunTimeout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6219]
nsGlobalWindow::TimerCallback  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6589]
nsAppStartup::Run  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 162]
main  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 61]
kernel32.dll + 0x1eb69 (0x77e5eb69)

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase (crashes on load)

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Sometimes, a null-check really is the right thing!

Comment 3

[Boris Zbarsky [:bzbarsky]]

Not sure whether this is worth it for 1.8.0.x branch.  roc, thoughts?

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 212192 [details] [diff] [review]
Fix

I think we may as well take it for 1.8.0.x, the risk is as low as it gets.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 212192 [details] [diff] [review]
Fix

Requesting 1.8.0.x approval.  This is a simple null-check crash fix; should be very safe.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed on trunk and 1.8.1

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

No crash loading/reloading testcase: https://bugzilla.mozilla.org/attachment.cgi?id=211724&action=view

on Windows XP SeaMonkey trunk Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060221 SeaMonkey/1.5a

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 212192 [details] [diff] [review]
Fix

approved for 1.8.0 branch, a=dveditz

Comment 9

[Boris Zbarsky [:bzbarsky]]

Fixed for 1.8.0.2

Comment 10

[Dave Liebreich [:davel]]

Marking [rft-dl] (ready for testing in Firefox 1.5.0.2 release candidates)

Comment 11

[Marcia Knous [:marcia]]

verified on the 1.8.0.2 branch using Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.2) Gecko/20060306 Firefox/1.5.0.2. I get no crash repeatedly loading and reloading the testcase listed in the bug.