302916 - Trunk crash [@ nsFocusController::GetWindowFromDocument]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Allan Beaufour]

FF trunk crashes for me in nsFocusController::GetWindowFromDocument(), as it
does not null-check doc->GetScriptGlobalObject().

Comment 1

[Allan Beaufour]

Attachment: Testcase

Not exactly "the simplest testcase in the world" :( Needs XForms support too.

1. view another page with a link to this testcase
2. view this testcase
3. press "insert at 3"
4. press the back-button in Firefox
-> crash

Comment 2

[Allan Beaufour]

Attachment: Patch

Simple null-check. Might just be hiding the real problem, dunno, it's the first
time I've ventured into dom/ :)

Comment 3

[Peter Van der Beken [:peterv]]

Dupe of bug 302894?

Comment 4

[Allan Beaufour]

(In reply to comment #3)
> Dupe of bug 302894?

Looks like it.

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 191182 [details] [diff] [review]
Patch

Yeah, this does look like the right thing to do here. r+sr=jst.

Thanks for the patch!

Comment 6

[timeless]

*** Bug 302894 has been marked as a duplicate of this bug. ***

Comment 7

[timeless]

*** Bug 302880 has been marked as a duplicate of this bug. ***

Comment 8

[Jay Patel [:jay]]

Adding topcrash+ keyword since this is a recent regression starting 7/31, we
have a testcase, and a patch ready to go.  Assigning to jst since he made some
changes recently to that part of the code.  Let's get this patched up.

Comment 9

[Johnny Stenback (:jst)]

Fix checked in, thanks for the patch!

Comment 10

[timeless]

*** Bug 302956 has been marked as a duplicate of this bug. ***

Comment 11

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2005-08-02-05 on Windows XP SeaMonkey trunk.