302988 - Crash on use of XBL-bound tag in XUL document when CSS stylesheet imports another via @import

Status: VERIFIED DUPLICATE of bug 255715

(Core :: XBL, defect)

Description

[Chris Fallin [:cfallin]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6

When a XUL document uses a tag bound via XBL, and the stylesheet specifying the
binding includes a line "@import url('anotherstylesheet.css')" at the top, a
crash occurs.

Reproducible: Always

Steps to Reproduce:
1. Create a bare XUL document with one tag as content - say, <widget/>, and a
reference to css1.css.
2. Create a CSS stylesheet with "@import url('css2.css')" at the top, and create
a binding in this CSS stylesheet to an XBL binding. Create an empty file "css2.css".
3. Create the XBL binding with something like <xul:label value="You Should See
This"/> as anonymous content.
4. Load the XUL page in Firefox.

Actual Results:  
Firefox crashed.

Expected Results:  
The XUL document should display correctly.

Comment 1

[Chris Fallin [:cfallin]]

Attachment: test case XUL document

Comment 2

[Chris Fallin [:cfallin]]

Attachment: Test case: first CSS stylesheet

Comment 3

[Chris Fallin [:cfallin]]

Attachment: Test case: XBL bindings file

Comment 4

[Chris Fallin [:cfallin]]

The test case has been uploaded to
http://www.c1f.net/misc/moz-bug-302988/bug.xul . Warning: this link will crash
Firefox 1.0.6 (on WinXP at least).

Comment 5

[Chris Fallin [:cfallin]]

This bug actually occurred with Firefox 1.0.6's versions of everything, not
'Trunk' as is shown above - my apologies, I don't know which version that
corresponds to.

Comment 6

[Steve England [:stevee]]

This crashes me on 1.06, but not with 
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b4) Gecko/20050731
Firefox/1.0+ ID:2005073111

Reporter, can you check with Deer Park Alpha 2 (Firefox 1.5 alpha) and verify
that this bug has been fixed? Then it can be marked WORKSFORME.

Comment 7

[Chris Fallin [:cfallin]]

I have verified that my test case works with Deer Park Alpha 2, with User-Agent
string "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b3) Gecko/20050712
Firefox/1.0+". Thank you for your help!

Comment 8

[O. Atsushi (Torisugari)]

(In reply to comment #4)
> http://www.c1f.net/misc/moz-bug-302988/bug.xul

WFM with 1.0.6
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716
Firefox/1.0.6

Comment 9

[Frank Wein [:mcsmurf]]

Stacktrace:
nsXBLPrototypeBinding::GetImmediateChild(nsXBLPrototypeBinding * const
0x00000000, nsIAtom * 0x0024e4d8) line 711
nsXBLPrototypeBinding::Initialize(nsXBLPrototypeBinding * const 0x00000000) line
278 + 17 bytes
nsXBLContentSink::HandleEndElement(nsXBLContentSink * const 0x0024ea68, const
unsigned short * 0x0272104a) line 375
nsExpatDriver::HandleEndElement(nsExpatDriver * const 0x00000000, const unsigned
short * 0x0272104a) line 374
Driver_HandleEndElement(void * 0x026cd3f0, const char * 0x0272104a) line 80
doContent(void * 0x01f825c8, int 0, const encoding * 0x02820608, const char *
0x028205f4, const char * 0x0282062a, const char * * 0x0012fb48) line 1509
contentProcessor(void * 0x01f824c8, const char * 0x0282042e, const char *
0x0282062a, const char * * 0x0012fb48) line 1112 + 27 bytes
doProlog(void * 0x01f825cc, const encoding * 0x0181a678 little2_encoding, const
char * 0x00000002, const char * 0x0282062a, int 29, const char * 0x0282042e,
const char * * 0x0012fb48) line 2396 + 23 bytes
prologProcessor(void * 0x0282042a, const char * 0x02820400, const char *
0x0282062a, const char * * 0x0012fb48) line 2254 + 22 bytes
prologInitProcessor(void * 0x01f824c8, const char * 0x02820400, const char *
0x0282062a, const char * * 0x0012fb48) line 2243 + 28 bytes
MOZ_XML_Parse(void * 0x01f824c8, const char * 0x02820400, int 554, int 0) line
926 + 19 bytes
nsExpatDriver::ParseBuffer(nsExpatDriver * const 0x00000000, const char *
0x02820400, unsigned int 554, int 0) line 838 + 16 bytes

*** This bug has been marked as a duplicate of 255715 ***

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

verified dup