Closed
Bug 849601
Opened 11 years ago
Closed 11 years ago
Crash with mutation listener, mutation observer, outerHTML
Categories
(Core :: DOM: Core & HTML, defect)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
FIXED
mozilla22
People
(Reporter: jruderman, Assigned: smaug)
Details
(Keywords: crash, csectype-nullptr, testcase)
Crash Data
Attachments
(3 files)
Reporter | ||
Comment 1•11 years ago
|
||
Comment 2•11 years ago
|
||
On Windows: bp-b30bdc05-8c74-49e9-b7fa-f59d02130310.
Crash Signature: [@ nsAutoMutationBatch::NodesAdded]
[@ nsINode::ReplaceOrInsertBefore] → [@ nsAutoMutationBatch::NodesAdded() ]
[@ nsINode::GetNextSibling(nsIDOMNode**) ]
OS: Mac OS X → All
Hardware: x86_64 → All
Assignee | ||
Updated•11 years ago
|
Assignee: nobody → bugs
Assignee | ||
Updated•11 years ago
|
Group: core-security
Assignee | ||
Comment 3•11 years ago
|
||
crash-stat stack trace looks odd.
Assignee | ||
Comment 5•11 years ago
|
||
This should do it. outerHTML just inserts fragment so we can rely on normal mutationbatch handling. We do have some tests for outerHTML + MutationObserver https://tbpl.mozilla.org/?tree=Try&rev=f698b1dd8e54
Assignee | ||
Comment 6•11 years ago
|
||
Comment on attachment 723195 [details] [diff] [review] patch Hmm, I thought I has asked review for this.
Attachment #723195 -
Flags: review?(jonas)
Updated•11 years ago
|
Keywords: csec-nullptr
Comment on attachment 723195 [details] [diff] [review] patch Review of attachment 723195 [details] [diff] [review]: ----------------------------------------------------------------- I won't have time to look at this so would be great if you could find another reviewer. It wasn't obvious to me though what the problem of the current code is so you might want to explain that to whoever ends up reviewing.
Attachment #723195 -
Flags: review?(jonas) → review?
Assignee | ||
Comment 8•11 years ago
|
||
Comment on attachment 723195 [details] [diff] [review] patch In the current code SetOuterHTML doesn't push script blocker to stack, so ReplaceChild may end up running mutation events and that confuses nsAutoMutationBatch. I'll investigate how to add an assert to MutationBatch to catch these cases.
Attachment #723195 -
Flags: review? → review?(bzbarsky)
Comment 9•11 years ago
|
||
Comment on attachment 723195 [details] [diff] [review] patch So there's another mutation batch inside the ReplaceChild that actually reports the mutations, right? r=me
Attachment #723195 -
Flags: review?(bzbarsky) → review+
Assignee | ||
Comment 10•11 years ago
|
||
Right. We do report it normally since we just replace some node with document fragment.
Assignee | ||
Comment 11•11 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/b09f11bca869
Comment 12•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/b09f11bca869
Status: NEW → RESOLVED
Closed: 11 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
Updated•5 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•