278575 - Crash in nsContentList::Match()

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Simon Fraser [no longer active]]

Some Camino users are crashing in nsContentList::Match(), and talkback shows
such crashes in Firefox on Windows too:

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=nsContentList%3A%3AMatch&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

This seemed to start in 12/26 builds.

Comment 1

[Simon Fraser [no longer active]]

See also bug 278457, which has the same start date.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I don't see any checkins between 2004-12-23-00 and 2004-12-27-23 that could have
really caused this to start happening...  The content list code itself has not
changed since 2004-12-01, and I don't see any real parser or content changes in
the 4-day period above...

I do see one thing that could be a little weird -- we're calling 
IndexOf(..., PR_FALSE) on a content list while under parser code.  This means
the content list may end up grabbing a form node that the content sink hasn't
notified for yet, and then possibly end up with two copies of that form node in
its list.  I thought the code protected against that (via its
CompareDocumentPosition checks), but this is the only thing I can think of
offhand...

Comment 3

[Wayne Mery (:wsmwk)]

tb56321739 watchtvsitcoms.com

there are several nsContentList::Match in 3.x
http://crash-stats.mozilla.com/query/query?product=Firefox&version=ALL%3AALL&date=&range_value=4&range_unit=weeks&query_search=signature&query_type=contains&query=nsContentList%3A%3AMatch&do_query=1

is this bug same as bp-0219211b-4855-4548-a203-0e0672091110?
  nsContentList::Match(nsIContent*)

Comment 4

[Wayne Mery (:wsmwk)]

I don't find any crashes

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Wayne Mery (:wsmwk) from comment #4)
> I don't find any crashes

I should rephrase that. no crash sigs of nsContentList::Match()

However we do have 
nsContentList::Match(nsIContent*) (v3.0 only)
nsContentList::Match(mozilla::dom::Element*) 
nsContentList::Match (Mac)

filed bug 725963 for the last two