1411088 - Crash in mozilla::dom::AutoEntryScript::AutoEntryScript parsing a custom element in an XHTML document

Status: RESOLVED DUPLICATE of bug 1378079

(Core :: DOM: Core & HTML, defect, P2)

Description

[Matthew N. [:MattN]]

Attachment: Testcase

This bug was filed from the Socorro interface and is 
report bp-b90ad092-15ee-4f2f-9241-2a30d0171023.
=============================================================

STR:
1) Enable custom element prefs
2) Add a custom element to an XHTML document (to be parsed, not via createElement)
3) Load that page

Expected result:
Page and component renders

Actual result:
Crash in:
> mozilla::dom::AutoEntryScript::AutoEntryScript(nsIGlobalObject*, char const*, bool)
>   NS_NewHTMLElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsTSubstring<char16_t> const*)
>     NS_NewElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsTSubstring<char16_t> const*)
> …

Comment 1

[Edgar Chen [:edgar] (Parental leave until Oct. 09.)]

Hmm, there will be no entry script if create element calls is from parser, but we still try to get entry global and will hit the assertion in http://searchfox.org/mozilla-central/rev/d30462037ffea383e74c42542c820cf65b2b144e/dom/html/nsHTMLContentSink.cpp#299 on debug build.

We didn't hit this in HTML document is because HTML parser doesn't go the same call path right now, I suspect we will hit this on HTML document after bug 1378079.

Comment 2

[Jessica Jong [:jessica] (inactive)]

(In reply to Edgar Chen [:edgar] from comment #1)
> Hmm, there will be no entry script if create element calls is from parser,
> but we still try to get entry global and will hit the assertion in
> http://searchfox.org/mozilla-central/rev/
> d30462037ffea383e74c42542c820cf65b2b144e/dom/html/nsHTMLContentSink.cpp#299
> on debug build.
> 
> We didn't hit this in HTML document is because HTML parser doesn't go the
> same call path right now, I suspect we will hit this on HTML document after
> bug 1378079.

In bug 1378079, we use node document's global object if it is called from parser, see bug 1378079 attachment 8918165 [details] [diff] [review].

Comment 3

[Edgar Chen [:edgar] (Parental leave until Oct. 09.)]

(In reply to Jessica Jong [:jessica] from comment #2)
> (In reply to Edgar Chen [:edgar] from comment #1)
> > Hmm, there will be no entry script if create element calls is from parser,
> > but we still try to get entry global and will hit the assertion in
> > http://searchfox.org/mozilla-central/rev/
> > d30462037ffea383e74c42542c820cf65b2b144e/dom/html/nsHTMLContentSink.cpp#299
> > on debug build.
> > 
> > We didn't hit this in HTML document is because HTML parser doesn't go the
> > same call path right now, I suspect we will hit this on HTML document after
> > bug 1378079.
> 
> In bug 1378079, we use node document's global object if it is called from
> parser, see bug 1378079 attachment 8918165 [details] [diff] [review].

Ah, right, so let's wait bug 1378079.

Comment 4

[Edgar Chen [:edgar] (Parental leave until Oct. 09.)]

Bug 1378079 fixes this crash, close as duplicated of bug 1378079.