13295 - crash in nsJSUtils::nsConvertObjectToJSVal (document.createElementWithNameSpace)

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Mike Shaver (:shaver emeritus)]

Trying to generate a test case for 7997 (alecf's bug, not rods'), I find myself
crashing in

0x4046f88e in nsJSUtils::nsConvertObjectToJSVal (aSupports=0x40091f02,
    aContext=0x86a5250, aReturn=0xbfffe788)
    at ../../../../dom/src/base/nsJSUtils.cpp:133
133         if (NS_OK == aSupports->QueryInterface(kIScriptObjectOwnerIID,
(void**)&owner)) {

#1  0x4047dd41 in NSDocumentCreateElementWithNameSpace (cx=0x86a5a68,
    obj=0x8692d78, argc=2, argv=0x82eb3e8, rval=0xbfffe788)
    at ../../../../dom/src/coreDOM/nsJSDocument.cpp:769

I'll attach my test case to this bug.

(Sorry to add to your woes; I was trying to see if I could fix 7997 for joki.)

Comment 1

[Mike Shaver (:shaver emeritus)]

Attachment: test case (produces crash in apprunner)

Comment 2

[Mike Shaver (:shaver emeritus)]

More data: createElement doesn't crash this way.  Also, viewer sees the same
crash pattern, which may make it more pleasant to debug.

Comment 3

[Mike Shaver (:shaver emeritus)]

``Don't do that, then'' was the resolution, though we should make it not crash.

Comment 4

[Mike Shaver (:shaver emeritus)]

Crashes are all M11/P1/critical.

Comment 5

[vidur (gone)]

document.createElementWithNameSpace() was only implemented for XML documents.
Invoking it now throws a "method not implemented" exception.

Comment 6

[leger]

Adding crash keyword

Comment 7

[Prashant Desale]

Verified with 2000-12-15.