115105 - crash dereferencing null for bad xbl

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[timeless]

Core was generated by `mozilla-bin'.
Program terminated with signal 11, Segmentation fault.

#0  0x292f8a6d in nsBindingManager::RemoveXBLDocumentInfo (this=0x885f680, aDocumentInfo=0x0)
    at /home/timeless/mozilla/content/xbl/src/nsBindingManager.cpp:971
971       aDocumentInfo->GetDocument(getter_AddRefs(doc));
(gdb) p aDocumentInfo
$1 = (nsIXBLDocumentInfo *) 0x0
(gdb) up
#1  0x292f3b3b in nsXBLService::LoadBindingDocumentInfo (this=0x822fc00, aBoundElement=0x885f2c0,
    aBoundDocument=0x87f2000, aURLStr=@0xbfbfdcd0, aRef=@0xbfbfdc78, aForceSyncLoad=0, aResult=0xbfbfdc6c)
    at /home/timeless/mozilla/content/xbl/src/nsXBLService.cpp:1150
1150            xblDocBindingManager->RemoveXBLDocumentInfo(info); // Break the self-imposed cycle.
(gdb) p info
$2 = {mRawPtr = 0x0}
(gdb) list
1145
1146          if (document) {
1147            nsCOMPtr<nsIBindingManager> xblDocBindingManager;
1148            document->GetBindingManager(getter_AddRefs(xblDocBindingManager));
1149            xblDocBindingManager->GetXBLDocumentInfo(aURLStr, getter_AddRefs(info));
1150            xblDocBindingManager->RemoveXBLDocumentInfo(info); // Break the self-imposed cycle.
1151
1152            if (!info) {
1153              NS_ERROR("An XBL file is malformed.  Did you forget the XBL namespace on the bindings tag?");
1154              return NS_ERROR_FAILURE;

move line 1150 into the 1152 block.

Comment 1

[timeless]

Attachment: don't break the cycle unles there's a cycle to break

whoops. *after* not into.

Comment 2

[Brian Ryner (not reading)]

Comment on attachment 61606 [details] [diff] [review]
don't break the cycle unles there's a cycle to break

r=bryner

Comment 3

[Alec Flett]

Comment on attachment 61606 [details] [diff] [review]
don't break the cycle unles there's a cycle to break

sr=alecf

Comment 4

[Brendan Eich [:brendan]]

This is fine for 0.9.7 too (as is bug 115124's patch, with a space around each
operator in the + lines as requested).

/be

Comment 5

[timeless]

fix checked in