145741 - Crash when trying to access complete property of Image [@ nsHTMLImageElement::GetImageFrame]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Marc Loiselle]

Buildid 2002051721 on Linux

A crash happens when javascript tries to access "complete" property of Image
javascript object.  null should be returned.

I will attach a minimal testcase.  The testcase comes from serverwatch.internet.com.

Comment 1

[Marc Loiselle]

Attachment: testcase

Comment 2

[Johnny Stenback (:jst)]

This is a recent regression caused by the fix for bug 74091. Fix coming up.

Comment 3

[Johnny Stenback (:jst)]

Attachment: Don't call CallQueryInterface() on null pointers.

Comment 4

[ArronM (:paper)]

*** This bug has been marked as a duplicate of 145371 ***

Comment 5

[harishd]

Comment on attachment 84288 [details] [diff] [review]
Don't call CallQueryInterface() on null pointers.

r=harishd

Comment 6

[harishd]

*** Bug 145371 has been marked as a duplicate of this bug. ***

Comment 7

[Johnny Stenback (:jst)]

Oh, nice circular dupes! :-)

Reopening this one since the patch in the other bug is incorrect (fixes the
problem, but it incorrectly returns an error for a non-error case).

Comment 8

[Johnny Stenback (:jst)]

Fix checked in.

Comment 9

[ArronM (:paper)]

Just a note that the code before the Bug 74091's patch checked for the existence
of frame and returned a rv (which was probably *not* NS_OK).  This patch returns
NS_OK.  It shouldn't cause any problems, but I think it's worthy to note in case
some day it does.

Comment 10

[Johnny Stenback (:jst)]

That may be, but returning an error code from GetImageFrame() just because
there's no frame, is just wrong. The absense of a frame for that element is a
very normal case (as we've seen in the crash frequency that was caused by this
regression), it's not an error.

Comment 11

[joakim_46]

WFM with build 2002051006 under Windows ME.

Comment 12

[Johnny Stenback (:jst)]

Yup, this was intorduced on 5/17...

Comment 13

[Jay Patel [:jay]]

Adding [@ nsHTMLImageElement::GetImageFrame] to summary and keywords for future
reference.  This was a topcrash with recent MozillaTrunk builds.

Comment 14

[John Morrison]

*** Bug 145821 has been marked as a duplicate of this bug. ***

Comment 15

[ArronM (:paper)]

*** Bug 145711 has been marked as a duplicate of this bug. ***

Comment 16

[Marc Loiselle]

wfm with buildid 2002052021 on linux.

Comment 17

[Jay Patel [:jay]]

v.fixed...no crashes in Talkback data since 5/20.