265184 - [FIX]Crash in XBL when <handlers> comes inside <implementation>

Status: RESOLVED FIXED

(Core :: XBL, defect, P1)

Description

[Boris Zbarsky [:bzbarsky]]

This was a case overlooked by the patch in bug 223799.

The basic problem is that we open <implementation> in the XBL sink (but not the
XML one.  Then we try to open <handlers>, go into error mode, and stop doing
weird XBL stuff... so when </implementation> comes around we actually close it
in the XML sink (which doesn't check whether the right thing is being closed,
because expat wouldn't allow the wrong thing to be closed).  Then when we try to
close <bindings> we crash (or rather PR_ASSERT, but the result is the same) in
nsXMLContentSink::HandleEndElement because we've already closed the document
element.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: XBL for testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: HTML for testcase

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 162721 [details] [diff] [review]
Patch

sr=jst

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

*** Bug 219006 has been marked as a duplicate of this bug. ***

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fix checked in.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

*** Bug 253376 has been marked as a duplicate of this bug. ***