Closed Bug 1401726 Opened 7 years ago Closed 7 years ago

Crash near null [@GetBoolFlag]

Categories

(Core :: DOM: Core & HTML, defect, P1)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla58
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox55 --- unaffected
firefox56 --- wontfix
firefox57 --- fixed
firefox58 --- fixed

People

(Reporter: jkratzer, Assigned: jdai)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Attachments

(3 files)

trigger.html
627 bytes, text/html
Details
Bug 1401726 - Fix crash in nsLabelsNodeList::PopulateSelf.
2.11 KB, patch
smaug
: review+
Details | Diff | Splinter Review
(Beta) Bug 1401726 - Fix crash in nsLabelsNodeList::PopulateSelf.
1.85 KB, patch
jdai
: review+
Sylvestre
: approval-mozilla-beta+
Details | Diff | Splinter Review
Attached file trigger.html —
Testcase found while fuzzing mozilla-central rev a20de99fa3c1. ==16005==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000001c (pc 0x7f440bd8efaa bp 0x7ffef99e5810 sp 0x7ffef99e57e0 T0) ==16005==The signal is caused by a READ memory access. ==16005==Hint: address points to the zero page. #0 0x7f440bd8efa9 in GetBoolFlag /builds/worker/workspace/build/src/dom/base/nsINode.h:1615:12 #1 0x7f440bd8efa9 in IsElement /builds/worker/workspace/build/src/dom/base/nsINode.h:457 #2 0x7f440bd8efa9 in nsLabelsNodeList::PopulateSelf(unsigned int) /builds/worker/workspace/build/src/dom/base/nsContentList.cpp:1273 #3 0x7f440bd892b3 in BringSelfUpToDate /builds/worker/workspace/build/src/dom/base/nsContentList.cpp:1049:5 #4 0x7f440bd892b3 in Length /builds/worker/workspace/build/src/dom/base/nsContentList.cpp:526 #5 0x7f440bd892b3 in nsContentList::GetLength(unsigned int*) /builds/worker/workspace/build/src/dom/base/nsContentList.cpp:667 #6 0x7f440c65a854 in Length /builds/worker/workspace/build/src/dom/base/nsINodeList.h:47:5 #7 0x7f440c65a854 in mozilla::dom::NodeListBinding::get_length(JSContext*, JS::Handle<JSObject*>, nsINodeList*, JSJitGetterCallArgs) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/NodeListBinding.cpp:68 #8 0x7f440d95a5f6 in mozilla::dom::GenericBindingGetter(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2924:13 #9 0x7f4413fcda24 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15 #10 0x7f4413fcda24 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495 #11 0x7f4413fcf45f in InternalCall /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:540:12 #12 0x7f4413fcf45f in Call /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:559 #13 0x7f4413fcf45f in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:674 #14 0x7f4414f7ba65 in CallGetter /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2123:16 #15 0x7f4414f7ba65 in GetExistingProperty<js::AllowGC::CanGC> /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2171 #16 0x7f4414f7ba65 in NativeGetPropertyInline<js::AllowGC::CanGC> /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2385 #17 0x7f4414f7ba65 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2421 #18 0x7f4414a1de7c in GetProperty /builds/worker/workspace/build/src/js/src/vm/NativeObject.h:1540:12 #19 0x7f4414a1de7c in JS_ForwardGetPropertyTo(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2652 #20 0x7f440d95280f in mozilla::dom::GetPropertyOnPrototype(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, bool*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2097:10 #21 0x7f440c5de7e6 in mozilla::dom::NodeListBinding::DOMProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) const /builds/worker/workspace/build/src/obj-firefox/dom/bindings/NodeListBinding.cpp:445:8 #22 0x7f4414cb1ff0 in getInternal /builds/worker/workspace/build/src/js/src/proxy/Proxy.cpp:338:21 #23 0x7f4414cb1ff0 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/proxy/Proxy.cpp:348 #24 0x7f4413fd7e3b in GetProperty /builds/worker/workspace/build/src/js/src/vm/NativeObject.h:1539:16 #25 0x7f4413fd7e3b in GetProperty /builds/worker/workspace/build/src/js/src/jsobj.h:834 #26 0x7f4413fd7e3b in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:4426 #27 0x7f4413fba6dc in GetPropertyOperation /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:218:12 #28 0x7f4413fba6dc in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2803 #29 0x7f4413f9eb4b in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:435:12 #30 0x7f4413fd0337 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:724:15 #31 0x7f4413fd0ba2 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:756:12 #32 0x7f4414a34c79 in ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4667:12 #33 0x7f440bf5d729 in nsJSUtils::ExecutionContext::CompileAndExec(JS::CompileOptions&, JS::SourceBufferHolder&, JS::MutableHandle<JSScript*>) /builds/worker/workspace/build/src/dom/base/nsJSUtils.cpp:265:8 #34 0x7f440f6458d8 in mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:2244:25 #35 0x7f440f640d0c in mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1884:10 #36 0x7f440f624575 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1585:10 #37 0x7f440f620ad8 in mozilla::dom::ScriptElement::MaybeProcessScript() /builds/worker/workspace/build/src/dom/script/ScriptElement.cpp:149:18 #38 0x7f440ae75b1f in AttemptToExecute /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIScriptElement.h:225:18 #39 0x7f440ae75b1f in nsHtml5TreeOpExecutor::RunScript(nsIContent*) /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:701 #40 0x7f440ae6f46a in nsHtml5TreeOpExecutor::RunFlushLoop() /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:502:7 #41 0x7f440ae7959b in nsHtml5ExecutorFlusher::Run() /builds/worker/workspace/build/src/parser/html/nsHtml5StreamParser.cpp:130:20 #42 0x7f44092ec91d in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039:14 #43 0x7f44092f2658 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:521:10 #44 0x7f440a0969b1 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 #45 0x7f4409ff887b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #46 0x7f4409ff887b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #47 0x7f4409ff887b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #48 0x7f440f7a465f in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27 #49 0x7f4413900271 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:288:30 #50 0x7f4413ae0dbb in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4701:22 #51 0x7f4413ae29b8 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4865:8 #52 0x7f4413ae3deb in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4960:21 #53 0x4ebea3 in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:236:22 #54 0x4ebea3 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:309 #55 0x7f44270b682f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #56 0x41d9f8 in _start (/home/forb1dden/builds/mc-asan/firefox+0x41d9f8) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/base/nsINode.h:1615:12 in GetBoolFlag ==16005==ABORTING
Flags: in-testsuite?
This is new code
Flags: needinfo?(jdai)
Assignee: nobody → jdai
Priority: -- → P1
When I wrote crash test about this bug, I saw there are several assertions[1] came from nsINode::SubtreeRoot[2]. It's only happened at debug build, I will put assertion expection in crashtests.list and file another bug to fix this[3]. Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=77a067f5498c19daa2f2dac4666b731d39fd707a&filter-tier=1&group_state=expanded [1] Assertion meeages is "These should always be in sync!: 'slowNode == node'" [2] https://searchfox.org/mozilla-central/rev/2ef8bd8a46a02c68ddbb1d5f25fa254dd7be1fbd/dom/base/nsINode.cpp#308 [3] Call stack: [Child 2553, Main Thread] ###!!! ASSERTION: These should always be in sync!: 'slowNode == node', file /home/john/workspace/john/workspace/firefox/dom/base/nsINode.cpp, line 308 #01: nsINode::SubtreeRoot() const (/home/john/workspace/john/workspace/firefox/dom/base/nsINode.cpp:308 (discriminator 1)) #02: nsGenericHTMLElement::UnbindFromTree(bool, bool) (/home/john/workspace/john/workspace/firefox/dom/html/nsGenericHTMLElement.cpp:534) #03: nsGenericHTMLFormElement::UnbindFromTree(bool, bool) (/home/john/workspace/john/workspace/firefox/dom/html/nsGenericHTMLElement.cpp:1942) #04: mozilla::dom::HTMLButtonElement::UnbindFromTree(bool, bool) (/home/john/workspace/john/workspace/firefox/dom/html/HTMLButtonElement.cpp:350) #05: mozilla::dom::Element::UnbindFromTree(bool, bool) (/home/john/workspace/john/workspace/firefox/dom/base/Element.cpp:1988 (discriminator 2)) #06: nsGenericHTMLElement::UnbindFromTree(bool, bool) (/home/john/workspace/john/workspace/firefox/dom/html/nsGenericHTMLElement.cpp:538) #07: mozilla::dom::HTMLSharedElement::UnbindFromTree(bool, bool) (/home/john/workspace/john/workspace/firefox/dom/html/HTMLSharedElement.cpp:292) #08: nsINode::doRemoveChildAt(unsigned int, bool, nsIContent*, nsAttrAndChildArray&) (/home/john/workspace/john/workspace/firefox/dom/base/nsINode.cpp:1923) #09: mozilla::dom::FragmentOrElement::RemoveChildAt(unsigned int, bool) (/home/john/workspace/john/workspace/firefox/dom/base/FragmentOrElement.cpp:1365) #10: nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&) (/home/john/workspace/john/workspace/firefox/dom/base/nsINode.cpp:605) #11: nsRange::SurroundContents(nsINode&, mozilla::ErrorResult&) (/home/john/workspace/john/workspace/firefox/dom/base/nsRange.cpp:3014) #12: mozilla::dom::RangeBinding::surroundContents(JSContext*, JS::Handle<JSObject*>, nsRange*, JSJitMethodCallArgs const&) (/home/john/workspace/john/workspace/firefox/obj-x86_64-pc-linux-gnu/dom/bindings/RangeBinding.cpp:1103) #13: mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) (/home/john/workspace/john/workspace/firefox/dom/bindings/BindingUtils.cpp:3055) #14: js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (/home/john/workspace/john/workspace/firefox/js/src/jscntxtinlines.h:293) #15: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (/home/john/workspace/john/workspace/firefox/js/src/vm/Interpreter.cpp:495) #16: InternalCall(JSContext*, js::AnyInvokeArgs const&) (/home/john/workspace/john/workspace/firefox/js/src/vm/Interpreter.cpp:541) #17: js::CallFromStack(JSContext*, JS::CallArgs const&) (/home/john/workspace/john/workspace/firefox/js/src/vm/Interpreter.cpp:547) #18: Interpret(JSContext*, js::RunState&) (/home/john/workspace/john/workspace/firefox/js/src/vm/Interpreter.cpp:3084) #19: js::RunScript(JSContext*, js::RunState&) (/home/john/workspace/john/workspace/firefox/js/src/vm/Interpreter.cpp:435) #20: js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) (/home/john/workspace/john/workspace/firefox/js/src/vm/Interpreter.cpp:724) #21: js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) (/home/john/workspace/john/workspace/firefox/js/src/vm/Interpreter.cpp:757) #22: ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) (/home/john/workspace/john/workspace/firefox/js/src/jsapi.cpp:4648) #23: ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::Value*) (/home/john/workspace/john/workspace/firefox/js/src/jsapi.cpp:4667) #24: JS_ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) (/home/john/workspace/john/workspace/firefox/js/src/jsapi.cpp:4689) #25: nsJSUtils::ExecutionContext::CompileAndExec(JS::CompileOptions&, JS::SourceBufferHolder&, JS::MutableHandle<JSScript*>) (/home/john/workspace/john/workspace/firefox/dom/base/nsJSUtils.cpp:265) #26: mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) (/home/john/workspace/john/workspace/firefox/dom/script/ScriptLoader.cpp:2244) #27: mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) (/home/john/workspace/john/workspace/firefox/dom/script/ScriptLoader.cpp:1884) #28: mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) (/home/john/workspace/john/workspace/firefox/dom/script/ScriptLoader.cpp:1585) #29: mozilla::dom::ScriptElement::MaybeProcessScript() (/home/john/workspace/john/workspace/firefox/dom/script/ScriptElement.cpp:149) #30: nsIScriptElement::AttemptToExecute() (/home/john/workspace/john/workspace/firefox/obj-x86_64-pc-linux-gnu/dist/include/nsIScriptElement.h:225) #31: nsHtml5TreeOpExecutor::RunScript(nsIContent*) (/home/john/workspace/john/workspace/firefox/parser/html/nsHtml5TreeOpExecutor.cpp:701) #32: nsHtml5TreeOpExecutor::RunFlushLoop() (/home/john/workspace/john/workspace/firefox/parser/html/nsHtml5TreeOpExecutor.cpp:505) #33: nsHtml5ExecutorFlusher::Run() (/home/john/workspace/john/workspace/firefox/parser/html/nsHtml5StreamParser.cpp:132) #34: mozilla::SchedulerGroup::Runnable::Run() (/home/john/workspace/john/workspace/firefox/xpcom/threads/SchedulerGroup.cpp:396) #35: nsThread::ProcessNextEvent(bool, bool*) (/home/john/workspace/john/workspace/firefox/xpcom/threads/nsThread.cpp:1035) #36: NS_ProcessNextEvent(nsIThread*, bool) (/home/john/workspace/john/workspace/firefox/xpcom/threads/nsThreadUtils.cpp:521) #37: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (/home/john/workspace/john/workspace/firefox/ipc/glue/MessagePump.cpp:125) #38: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (/home/john/workspace/john/workspace/firefox/ipc/glue/MessagePump.cpp:302) #39: MessageLoop::RunInternal() (/home/john/workspace/john/workspace/firefox/ipc/chromium/src/base/message_loop.cc:327) #40: MessageLoop::RunHandler() (/home/john/workspace/john/workspace/firefox/ipc/chromium/src/base/message_loop.cc:320) #41: MessageLoop::Run() (/home/john/workspace/john/workspace/firefox/ipc/chromium/src/base/message_loop.cc:298) #42: nsBaseAppShell::Run() (/home/john/workspace/john/workspace/firefox/widget/nsBaseAppShell.cpp:160) #43: XRE_RunAppShell() (/home/john/workspace/john/workspace/firefox/toolkit/xre/nsEmbedFunctions.cpp:880) #44: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (/home/john/workspace/john/workspace/firefox/ipc/glue/MessagePump.cpp:269) #45: MessageLoop::RunInternal() (/home/john/workspace/john/workspace/firefox/ipc/chromium/src/base/message_loop.cc:327) #46: MessageLoop::RunHandler() (/home/john/workspace/john/workspace/firefox/ipc/chromium/src/base/message_loop.cc:320) #47: MessageLoop::Run() (/home/john/workspace/john/workspace/firefox/ipc/chromium/src/base/message_loop.cc:298) #48: XRE_InitChildProcess(int, char**, XREChildData const*) (/home/john/workspace/john/workspace/firefox/toolkit/xre/nsEmbedFunctions.cpp:709) #49: mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) (/home/john/workspace/john/workspace/firefox/toolkit/xre/Bootstrap.cpp:66) #50: content_process_main(mozilla::Bootstrap*, int, char**) (/home/john/workspace/john/workspace/firefox/browser/app/../../ipc/contentproc/plugin-container.cpp:63) #51: main (/home/john/workspace/john/workspace/firefox/browser/app/nsBrowserApp.cpp:285) #52: __libc_start_main (/build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:325) #53: _start (/home/john/workspace/john/workspace/firefox/obj-x86_64-pc-linux-gnu/dist/bin/firefox) #54: ??? (???:???)
Flags: needinfo?(jdai)
Attachment #8910661 - Flags: review?(bugs)
"These should always be in sync!: 'slowNode == node'" is bad.
Comment on attachment 8910661 [details] [diff] [review] Bug 1401726 - Fix crash in nsLabelsNodeList::PopulateSelf. But I think that assertion is sort of transitional or how to say, since SubtreeRoot is called during UnbindFromTree. But definitely something to fix, asap.
Attachment #8910661 - Flags: review?(bugs) → review+
(In reply to Olli Pettay [:smaug] from comment #4) > Comment on attachment 8910661 [details] [diff] [review] > Bug 1401726 - Fix crash in nsLabelsNodeList::PopulateSelf. > > But I think that assertion is sort of transitional or how to say, since > SubtreeRoot is called during UnbindFromTree. But definitely something to > fix, asap. Thanks for your review. I'll fix them ASAP. File bug 1401915 for tracking.
Keywords: checkin-needed
Flags: in-testsuite? → in-testsuite+
Pushed by ryanvm@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/8e8def4061c5 Fix crash in nsLabelsNodeList::PopulateSelf. r=smaug
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/8e8def4061c5
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox58: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
Please request Beta approval on this when you get a chance.
Blocks: 556743
status-firefox55: --- → unaffected
status-firefox56: affected → wontfix
status-firefox-esr52: --- → unaffected
Flags: needinfo?(jdai)
Approval Request Comment [Feature/Bug causing the regression]: Bug 1401726 [User impact if declined]: Crashes on trying to use .labels. [Is this code covered by automated tests?]: Yes. [Has the fix been verified in Nightly?]: Yes. [Needs manual test from QE? If yes, steps to reproduce]: No. [List of other uplifts needed for the feature/fix]: None. [Is the change risky?]: No. [Why is the change risky/not risky?]: It's only one line null check change. [String changes made/needed]: None.
Flags: needinfo?(jdai)
Attachment #8911688 - Flags: review+
Attachment #8911688 - Flags: approval-mozilla-beta?
Comment on attachment 8911688 [details] [diff] [review] (Beta) Bug 1401726 - Fix crash in nsLabelsNodeList::PopulateSelf. Fix a crash, taking it. Should be in 57b3
Attachment #8911688 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: