1477544 - Crash in nsIContent::GetBaseURI

Status: VERIFIED FIXED

(Core :: SVG, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-1c65a4ce-ef9e-41eb-beea-892d30180722.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsIContent::GetBaseURI dom/base/FragmentOrElement.cpp:347
1 xul.dll nsGenericHTMLElement::GetURIAttr dom/html/nsGenericHTMLElement.cpp:1539
2 xul.dll mozilla::dom::HTMLAnchorElement::GetHrefURI dom/html/HTMLAnchorElement.cpp:294
3 xul.dll mozilla::dom::Link::LinkState dom/base/Link.cpp:374
4 xul.dll mozilla::dom::HTMLAnchorElement::IntrinsicState dom/html/HTMLAnchorElement.cpp:336
5 xul.dll mozilla::dom::Element::UpdateState dom/base/Element.cpp:260
6 xul.dll nsIDocument::RefreshLinkHrefs dom/base/nsDocument.cpp:8645
7 xul.dll mozilla::dom::HTMLSharedElement::UnbindFromTree dom/html/HTMLSharedElement.cpp:265
8 xul.dll mozilla::dom::Element::UnbindFromTree dom/base/Element.cpp:2086
9 xul.dll nsGenericHTMLElement::UnbindFromTree dom/html/nsGenericHTMLElement.cpp:473

=============================================================

There is 1 crash in nightly 63 with buildid 20180721220720. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1450250.

[1] https://hg.mozilla.org/mozilla-central/rev?node=453d0a08f00c

Comment 1

[Emilio Cobos Álvarez (:emilio)]

This one I can see how it happens. Thanks!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c151c08b5864
Add a null-check to handle unlinking properly. r=me

Comment 3

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/c151c08b5864

Comment 4

[Calixte Denizet (:calixte)]

No more crashes since the patch landed.