1787320 - Crash in [@ mozilla::dom::ResponsiveImageSelector::Content]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/e544b670-19da-4447-addd-7459c0220824

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 XUL mozilla::dom::ResponsiveImageSelector::Content dom/base/ResponsiveImageSelector.cpp:199
1 XUL mozilla::dom::HTMLImageElement::PictureSourceDimensionChanged dom/html/HTMLImageElement.cpp:1031
2 XUL mozilla::dom::HTMLSourceElement::AfterSetAttr dom/html/HTMLSourceElement.cpp:144
3 XUL mozilla::dom::Element::SetAttr dom/base/Element.cpp:2493
4 XUL mozilla::dom::Element_Binding::setAttribute dom/bindings/ElementBinding.cpp:1697
5 XUL mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3287
6 None @0x0000283c78ecc454 
7 None @0x0000283c78ecc454 
8 None @0x0000283c7907110c 
9 None @0x0000283c78ecc0fc 

Null deref crash. This signature is present in older versions, but it looks like it has started popping up fairly frequently on Nightly, so I think this is a regression, probably from bug 1694741, which has code in the stack and just landed.

Maybe mResponsiveSelector is null on this line?
if (mResponsiveSelector->Content() == aSourceNode) {

Comment 1

[Boris Chiou [:boris]]

Yes. My fault. We should do the null check in this line. Sorry for this.

Comment 2

[Boris Chiou [:boris]]

Attachment: Bug 1787320 - Add the missing null check for mResponsiveSelector.

PictureSourceDimensionChanged may be called by an image element with a null
selector (because we call this function on all the image elements after
the source element).

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0a4882c4bafb
Add the missing null check for mResponsiveSelector. r=emilio

Comment 4

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/0a4882c4bafb

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/0a4882c4bafb