267990 - crash [@ nsXFormsModelElement::DocumentChanged]

Status: RESOLVED FIXED

(Core Graveyard :: XForms, defect)

Description

[Darin Fisher]

crash [@ nsXFormsModelElement::DocumentChanged]

will attach stack trace

here's where we crash:

186         nsIScriptGlobalObject *window = doc->GetScriptGlobalObject();
187
188         nsCOMPtr<nsIDOMEventTarget> targ = do_QueryInterface(window);
189         targ->AddEventListener(NS_LITERAL_STRING("load"), this, PR_TRUE);

|targ| is null when we get to line 189.  it is null because |window| is null.

to repro, browse to the given URL.

Comment 1

[Darin Fisher]

Attachment: stack trace

Comment 2

[Darin Fisher]

If I hack around the problem with a 'NS_ENSURE_TRUE(window);', I then crash
inside nsXFormsInstanceElement::GetModel, which is being called by
nsXFormsInstanceElement::Load.

Comment 3

[Darin Fisher]

Attachment: reduced testcase

save this attachment locally as 'crash-bug-267990.xhtml', and then load it to
reproduce this crash.

Comment 4

[Darin Fisher]

this crash only appears to occur when the instance data is the document
containing the xforms.  is it possible that we crash because we are trying to
evaluate xforms in the instance document?

Comment 5

[Darin Fisher]

Alex:

Should XTF restrict bindings to cases where XML content is actually loading in a
browser window?  Or, how can we make sure that XForms is only invoked when
loading content in a browser window?

Comment 6

[Darin Fisher]

Attachment: v1 patch

Here's a solution for this crash that only involves changes to XForms.	I've
added some null checks, and added a check to ensure that we only load external
instance documents when the <instance> element lives in a document w/ an
associated DOM window.

Comment 7

[Brian Ryner (not reading)]

Comment on attachment 166916 [details] [diff] [review]
v1 patch

>+  // Do not try to load an instance document if the current document
>+  // is not associated with a DOM window.  This could happen if some
>+  // XForms document loaded itself as instance data.  Yes, it does

Really if it loaded any XML document that has XForms elements... doesn't need
to be itself.  r=me with a slight comment clarification.

Comment 8

[Darin Fisher]

fixed-on-trunk with tweak to comment.

Comment 9

[Ben Fowler]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a6) Gecko/20041201
Firefox/1.0+

No crash with the test case