111361 - Accessing DOM CSS constants causes crash.

Status: VERIFIED FIXED

(Core :: DOM: CSS Object Model, defect)

Description

[Mike Gratton]

Accessing DOM CSS constants is causing Moz 0.9.5+ and above to crash.

Simple assignements, such as:

  var foo = CSSValue.CSS_PRIMITIVE_VALUE

or comparisons, such as
  
  if (CSSPrimitiveValue.CSS_MM == bar)
    ...

will reproduce the crash.

For some test cases, see the document in the URL field.

I can reproduce this with Windows and Linux buiolds from 2001-11-21.

See talkback incident #TB38351590Q for talkback data from a 0.9.6 build. I'll
attach a stack trace from a recent nightly.

Comment 1

[Johnny Stenback (:jst)]

Attachment: Proposed fix.

Comment 2

[Johnny Stenback (:jst)]

Thanks for the testcase, this was trivial to fix given this nice and simple
testcase.

Comment 3

[John Bandhauer]

Comment on attachment 58820 [details] [diff] [review]
Proposed fix.

r/sr=jband

Comment 4

[Mike Gratton]

No problem, thanks for the quick turnaround. Is that some sort of record? 8)

Want me to do a build with the patch to confirm it fixes the crash?

Comment 5

[Johnny Stenback (:jst)]

No need to do a build, but if you want to, be my guest but I might check this in
real soon now :-)

Comment 6

[Mike Gratton]

Cool, I'll wait until you check it in.

Comment 7

[Bradley Baetz (:bbaetz)]

Comment on attachment 58820 [details] [diff] [review]
Proposed fix.

r=bbaetz

Comment 8

[Johnny Stenback (:jst)]

Fixed.

Comment 9

[Brendan Eich [:brendan]]

How about a comment in nsScriptNameSpaceManager.h telling which mType values
discriminate which union arms.

/be

Comment 10

[Boris Zbarsky [:bzbarsky]]

*** Bug 111027 has been marked as a duplicate of this bug. ***

Comment 11

[Johnny Stenback (:jst)]

Comments added.

Comment 12

[Mike Gratton]

Cool, the crash is gone, marking verified.