274648 - crash using repeat element on Windows

Status: RESOLVED FIXED

(Core Graveyard :: XForms, defect)

Description

[aaronr]

Mozilla can crash or hang on Windows if you use a testcase with a repeat element
in it.  There is an assertion: 
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file ../../dist/include/xpcom\nsCOMPtr.h, line 849
Error loading URL file:///X:/myprogs/xml/xforms/easyrepeat.xhtml : 804b0002

I'll attach testcase and patch.

Comment 1

[aaronr]

Attachment: testcase that shows problem

This case shows the problem.

The problem is with line 426 in nsXFormsRepeatElement.cpp:
rv = child->GetNextSibling(getter_AddRefs(child));

getter_AddRefs monkeys with the comptr before it is passed in, so child will
all of the sudden become nsnull before it is offset to find GetNextSibling
function.

Comment 2

[aaronr]

Attachment: proposed fix

proposed fix.  Testcase still doesn't show all of the items in the repeat, but
I don't think that has anything to do with the patch.

Comment 3

[Darin Fisher]

Comment on attachment 168732 [details] [diff] [review]
proposed fix

r+sr=darin (thinko!)

Comment 4

[Darin Fisher]

fixed-on-trunk

Comment 5

[Allan Beaufour]

(In reply to comment #2)
> Created an attachment (id=168732) [edit]
> proposed fix
> 
> proposed fix.  Testcase still doesn't show all of the items in the repeat, but
> I don't think that has anything to do with the patch.

Nope, that's a known bug (bug 266685). You need to style group and repeat so
they are styled properly.