293471 - crash by tesing 'Layout Regression Tests'

Status: RESOLVED DUPLICATE of bug 292717

(Core :: XBL, defect)

Description

[Hideo Saito]

When I tested following "Layout Regression Tests", Mozilla crashed.
 http://www.mozilla.org/newlayout/doc/regression_tests.html

The testcase causing a problem is http://www.hixie.ch/tests/evil/xml/010.xml.

mozilla-2005-02-25/Trunk has no problem,
mozilla-2005-02-26/Trunk has a problem.

I point the fault as follows. The calling |binding->MarkForDeath()| causes
memory fault, since the binding object is destroyed by calling |SetBinding|.

at ./content/xbl/src/nsBindingManager.cpp
nsBindingManager::RemoveLayeredBinding(nsIContent* aContent, nsIURI* aURL)
{
  nsXBLBinding *binding = nsBindingManager::GetBinding(aContent);
  
  if (!binding) {
    return NS_OK;
  }

  ...
  
  // Finally remove the binding...
  binding->UnhookEventHandlers();
  binding->ChangeDocument(doc, nsnull);
  SetBinding(aContent, nsnull);
  binding->MarkForDeath();        <-------------- causes memory fault

Comment 1

[Bernd]

I guess thats a regression from bug 194834,
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2005-02-25&maxdate=2005-02-26&cvsroot=%2Fcvsroot
I have seen that crash too, but was to lazy to file a bug (shame on me)

Comment 2

[Boris Zbarsky [:bzbarsky]]

Looks like bug 292717, right?

Comment 3

[Bernd]

yep, there you go

*** This bug has been marked as a duplicate of 292717 ***