Closed Bug 238005 Opened 20 years ago Closed 20 years ago

[FIXr]Crash on HTMLSelectElement.add when before param is option in different select element

Categories

(Core :: DOM: Core & HTML, defect, P1)

x86
Windows XP
defect

Tracking

()

RESOLVED FIXED
mozilla1.7final

People

(Reporter: carnold, Assigned: bzbarsky)

References

()

Details

(Keywords: crash)

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

DOM L2 HTML specifies that a NOT_FOUND_ERR should be thrown if the before param
is an OPTION but not part of the target SELECT on a call to
HTMLSelectElement.add.  This previously mentioned page is a stripped down
version of W3C DOM L2 HTML test HTMLSelectElement20 which tests that. 
Unfortunately, there does not appear to be any guard in the Mozilla code base
that checks that and getting through results in a crash.

Reproducible: Always
Steps to Reproduce:
1. Open to http://home.houston.rr.com/curta/select_crash.html
2. Press OK on Starting test alert


Actual Results:  
Stall and eventual crash

Expected Results:  
Displayed a "Test Succeeded" alert.

There would have been a Talkback on 18 Mar 2004 from me that would have been my
initial observation of the problem.
Note that I can't reproduce the bug with a current Linux, myself, but I'm
betting this will fix it for anyone who can.... (the bug depends on the order
some instructions get compiled in).
Assignee: general → bzbarsky
Status: UNCONFIRMED → ASSIGNED
Keywords: crash
Priority: -- → P1
Summary: Crash on HTMLSelectElement.add when before param is option in different select element → [FIX]Crash on HTMLSelectElement.add when before param is option in different select element
Target Milestone: --- → mozilla1.7final
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

caillon, peterv, would you review?
Attachment #144341 - Flags: superreview?(peterv)
Attachment #144341 - Flags: review?(caillon)
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

It would be nice if we could force |x->foo(getter_addRefs(x))| to not
compile...
Attachment #144341 - Flags: review?(caillon) → review+
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

I suppose we could integrate the |if (!parent)| into the while loop, but sure.
Attachment #144341 - Flags: superreview?(peterv) → superreview+
Summary: [FIX]Crash on HTMLSelectElement.add when before param is option in different select element → [FIXr]Crash on HTMLSelectElement.add when before param is option in different select element
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

Could this be approved for 1.7final?  Very safe change to not misuse
nsCOMPtr...
Attachment #144341 - Flags: approval1.7?
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

a=asa (on behalf of drivers) for checkin to 1.7
Attachment #144341 - Flags: approval1.7? → approval1.7+
Fxied for 1.7
Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: