144763 - tolerate do_QueryReferent() returning null - M100 N70PR1 [@ nsXULPrototypeScript::Compile]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[timeless]

Program received signal SIGSEGV, Segmentation fault.
0x294b9f9b in nsXULPrototypeScript::Compile (this=0x82b8c80, aText=0x84d4000, aTextLength=34, aURI=0x80d1500, aLineNo=118,
    aDocument=0x0, aPrototypeDocument=0x84927c0) at /home/timeless/mozilla/content/xul/content/src/nsXULElement.cpp:5437
5437        rv = aDocument->GetPrincipal(getter_AddRefs(principal));
Current language:  auto; currently c++
(gdb) p aDocument
$1 = (nsIDocument *) 0x0
(gdb) up
#1  0x294c4be7 in XULContentSinkImpl::HandleEndElement (this=0x8499500, aName=0x82ba70c)
    at /home/timeless/mozilla/content/xul/document/src/nsXULContentSink.cpp:947
947                                      script->mLineNo, doc, mPrototype);
(gdb) l
942                 nsCOMPtr<nsIDocument> doc = do_QueryReferent(mDocument);
943
944                 script->mOutOfLine = PR_FALSE;
945
946                 rv = script->Compile(mText, mTextLength, mDocumentURL,
947                                      script->mLineNo, doc, mPrototype);
948             }
949
950             FlushText(PR_FALSE);
951         }
(gdb) p doc
$2 = {mRawPtr = 0x0}

Comment 1

[Boris Zbarsky [:bzbarsky]]

*** Bug 144764 has been marked as a duplicate of this bug. ***

Comment 2

[timeless]

Attachment: pass out the error instead of trying to crash

Comment 3

[Christian :Biesinger (don't email me, ping me on IRC)]

both uses of rv are not necessary in this patch, they're both unused

however, they might be useful for debuggers - do we care about rv's in general?

r=biesi with removing the two instances of rv, or clarification that they should
be kept

Comment 4

[harishd]

Comment on attachment 84521 [details] [diff] [review]
pass out the error instead of trying to crash

I agree with cbiesinger, rv is not used.

With that r=harishd

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 84521 [details] [diff] [review]
pass out the error instead of trying to crash

sr=jst

Comment 6

[timeless]

checked in without rv's.

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 84521 [details] [diff] [review]
pass out the error instead of trying to crash

please check into the 1.0.1 branch ASAP. once landed remove the 
mozilla1.0.1+ keyword and add the fixed1.0.1 keyword

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

Please make sure what you check in matches the trunk

Comment 9

[shrirang khanzode]

*stamp*

Comment 10

[Jay Patel [:jay]]

Adding topcrash+ keyword and M100 N70PR1 for future reference.  This has been a
topcrasher with Mozilla 1.0 and Netscape 7.0 PR1.