118528 - Access Violation [@inDOMView::AppendKidsToArray] [aKids==0]->GetLength(&l);

Status: RESOLVED FIXED

(Other Applications :: DOM Inspector, defect)

Description

[timeless]

inDOMView::AppendKidsToArray(nsIDOMNodeList * 0x00000000, nsISupportsArray * 0x05fde4e0) line 1226 + 7 bytes
inDOMView::GetChildNodesFor(nsIDOMNode * 0x04609844, nsISupportsArray * * 0x0012d8a4) line 1147
inDOMView::CreateNode(nsIDOMNode * 0x04609844, inDOMViewNode * 0x05fd0510) line 885 + 36 bytes
inDOMView::ExpandNode(int 16) line 986 + 21 bytes
inDOMView::ToggleOpenState(inDOMView * const 0x05e4a6a4, int 16) line 504
XPTC_InvokeByIndex(nsISupports * 0x05e4a6a4, unsigned int 22, unsigned int 1, nsXPTCVariant * 0x0012daa0) line 106
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode CALL_METHOD) line 2009 + 42 bytes
XPC_WN_CallMethod(JSContext * 0x05780e70, JSObject * 0x033d8a30, unsigned int 1, long * 0x03425a10, long * 0x0012dd3c) line 1266 + 14 bytes
js_Invoke(JSContext * 0x05780e70, unsigned int 1, unsigned int 0) line 832 + 23 bytes
js_Interpret(JSContext * 0x05780e70, long * 0x0012e604) line 2798 + 15 bytes
js_Invoke(JSContext * 0x05780e70, unsigned int 1, unsigned int 2) line 849 + 13 bytes
js_InternalInvoke(JSContext * 0x05780e70, JSObject * 0x033d81b0, long 54213968, unsigned int 0, unsigned int 1, long * 0x0012e874, long * 0x0012e72c) line 924 + 20 bytes
JS_CallFunctionValue(JSContext * 0x05780e70, JSObject * 0x033d81b0, long 54213968, unsigned int 1, long * 0x0012e874, long * 0x0012e72c) line 3405 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x054b0520, void * 0x033d81b0, void * 0x033b3d50, unsigned int 1, void * 0x0012e874, int * 0x0012e878, int 0) line 1011 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x05fde820, nsIDOMEvent * 0x05fdec08) line 180 + 77 bytes
nsXBLPrototypeHandler::ExecuteHandler(nsXBLPrototypeHandler * const 0x05ae6450, nsIDOMEventReceiver * 0x05aa4048, nsIDOMEvent * 0x05fdec08) line 443
DoKey(nsIAtom * 0x03048490, nsIXBLPrototypeHandler * 0x05ae6450, nsIDOMEvent * 0x05fdec08, nsIDOMEventReceiver * 0x05aa4048) line 108
nsXBLKeyHandler::KeyPress(nsXBLKeyHandler * const 0x05dff030, nsIDOMEvent * 0x05fdec08) line 123 + 40 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x05aa5fc0, nsIPresContext * 0x05a45d70, nsEvent * 0x0012f928, nsIDOMEvent * * 0x0012f6c4, nsIDOMEventTarget * 0x05aa4048, unsigned int 7, nsEventStatus * 0x0012f894) line 1636 + 41 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x05aa4040, nsIPresContext * 0x05a45d70, nsEvent * 0x0012f928, nsIDOMEvent * * 0x0012f6c4, unsigned int 1, nsEventStatus * 0x0012f894) line 3449
PresShell::HandleEventInternal(nsEvent * 0x0012f928, nsIView * 0x05a45550, unsigned int 1, nsEventStatus * 0x0012f894) line 6060 + 44 bytes
PresShell::HandleEvent(PresShell * const 0x05a46d54, nsIView * 0x05a45550, nsGUIEvent * 0x0012f928, nsEventStatus * 0x0012f894, int 1, int & 1) line 5985 + 25 bytes
nsView::HandleEvent(nsView * const 0x05a45550, nsGUIEvent * 0x0012f928, unsigned int 0, nsEventStatus * 0x0012f894, int 1, int & 1) line 387
nsViewManager::DispatchEvent(nsViewManager * const 0x05a456a0, nsGUIEvent * 0x0012f928, nsEventStatus * 0x0012f894) line 1930
HandleEvent(nsGUIEvent * 0x0012f928) line 83
nsWindow::DispatchEvent(nsWindow * const 0x05a45414, nsGUIEvent * 0x0012f928, nsEventStatus & nsEventStatus_eIgnore) line 847 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f928) line 868
nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 39) line 2551 + 15 bytes
nsWindow::OnKeyDown(unsigned int 39, unsigned int 333) line 2623

inDOMView::GetChildNodesFor(nsIDOMNode * 0x04609844, nsISupportsArray * * 0x0012d8a4) line 1147
        domdoc->GetChildNodes(getter_AddRefs(kids));
        AppendKidsToArray(kids, result);
GetChildNodes can fail, and this crash is a case where it did.

I'm also going to move |nsCOMPtr<nsIDOMNodeList> kids;| for portability reasons.
patch coming

Comment 1

[timeless]

Attachment: don't use kids if the setter fails

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 63786 [details] [diff] [review]
don't use kids if the setter fails

Move the declarations back to where they used to be.
The portability thing is for |for| loops in particular,
not for this case.

Maybe check for non-nullness of |kids|
instead of success?

> +        rv = aNode->GetChildNodes(getter_AddRefs(kids));

funky indentation there...

fix the decl and indentation and r=bzbarsky

Comment 3

[timeless]

Attachment: keep definitions where they belong

Comment 4

[Joe Hewitt (gone)]

Comment on attachment 65126 [details] [diff] [review]
keep definitions where they belong

sr=hewitt

Comment 5

[timeless]

fixed