[FIXr]Crash on HTMLSelectElement.add when before param is option in different select element

RESOLVED FIXED in mozilla1.7final

Status

()

P1
critical
RESOLVED FIXED
15 years ago
15 years ago

People

(Reporter: carnold, Assigned: bzbarsky)

Tracking

({crash})

Trunk
mozilla1.7final
x86
Windows XP
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(1 attachment)

(Reporter)

Description

15 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040316

DOM L2 HTML specifies that a NOT_FOUND_ERR should be thrown if the before param
is an OPTION but not part of the target SELECT on a call to
HTMLSelectElement.add.  This previously mentioned page is a stripped down
version of W3C DOM L2 HTML test HTMLSelectElement20 which tests that. 
Unfortunately, there does not appear to be any guard in the Mozilla code base
that checks that and getting through results in a crash.

Reproducible: Always
Steps to Reproduce:
1. Open to http://home.houston.rr.com/curta/select_crash.html
2. Press OK on Starting test alert


Actual Results:  
Stall and eventual crash

Expected Results:  
Displayed a "Test Succeeded" alert.

There would have been a Talkback on 18 Mar 2004 from me that would have been my
initial observation of the problem.
(Assignee)

Comment 1

15 years ago
Created attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

Note that I can't reproduce the bug with a current Linux, myself, but I'm
betting this will fix it for anyone who can.... (the bug depends on the order
some instructions get compiled in).
Assignee: general → bzbarsky
Status: UNCONFIRMED → ASSIGNED
(Assignee)

Updated

15 years ago
Keywords: crash
Priority: -- → P1
Summary: Crash on HTMLSelectElement.add when before param is option in different select element → [FIX]Crash on HTMLSelectElement.add when before param is option in different select element
Target Milestone: --- → mozilla1.7final
(Assignee)

Comment 2

15 years ago
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

caillon, peterv, would you review?
Attachment #144341 - Flags: superreview?(peterv)
Attachment #144341 - Flags: review?(caillon)
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

It would be nice if we could force |x->foo(getter_addRefs(x))| to not
compile...
Attachment #144341 - Flags: review?(caillon) → review+
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

I suppose we could integrate the |if (!parent)| into the while loop, but sure.
Attachment #144341 - Flags: superreview?(peterv) → superreview+
(Assignee)

Updated

15 years ago
Summary: [FIX]Crash on HTMLSelectElement.add when before param is option in different select element → [FIXr]Crash on HTMLSelectElement.add when before param is option in different select element
(Assignee)

Comment 5

15 years ago
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

Could this be approved for 1.7final?  Very safe change to not misuse
nsCOMPtr...
Attachment #144341 - Flags: approval1.7?

Comment 6

15 years ago
Comment on attachment 144341 [details] [diff] [review]
Actually, we have a check.  It's just wrong.

a=asa (on behalf of drivers) for checkin to 1.7
Attachment #144341 - Flags: approval1.7? → approval1.7+
(Assignee)

Comment 7

15 years ago
Fxied for 1.7
Status: ASSIGNED → RESOLVED
Last Resolved: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.