Closed Bug 321810 Opened 19 years ago Closed 19 years ago

Crash with CTRL+B & Manage Bookmarks [@ nsXULElement::GetAttrNameAt]

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: u88484, Assigned: sicking)

References

(
URL
)

Details

(Keywords: crash, regression)

Crash Data

Firefox crashes when CTRL+B is pressed to open the Bookmarks in the sidebar.

TB13378572Q

Stack Signature	 nsXULElement::GetAttrNameAt ec84f072
Product ID	FirefoxTrunk
Build ID	2005122905
Trigger Time	2005-12-29 08:16:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (00192c83)
URL visited	
User Comments	
Since Last Crash	13 sec
Total Uptime	13 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1523
Stack Trace 	
nsXULElement::GetAttrNameAt  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1523]
nsXULTemplateBuilder::CompileSimpleRule  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 2186]
nsXULTemplateBuilder::CompileRules  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 1567]
nsXULTreeBuilder::RebuildAll  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 1343]
nsXULTemplateBuilder::Rebuild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 244]
nsXULTreeBuilder::SetTree  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 835]
nsTreeBodyFrame::SetView  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 571]
nsTreeBodyFrame::EnsureView  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 461]
nsTreeBodyFrame::GetMinSize  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 261]
nsBox::GetPrefSize  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 703]
nsBox::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 781]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564]
nsBoxFrame::GetAscent  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970]
nsSprocketLayout::Layout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 260]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1089]
nsBoxFrame::DoLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1089]
nsRootBoxFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 215]
nsContainerFrame::ReflowChild  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 891]
ViewportFrame::Reflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 230]
PresShell::InitialReflow  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 2767]
nsXULDocument::StartLayout  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2106]
nsXULDocument::ResumeWalk  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3146]
nsXULDocument::OnStreamComplete  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3430]
nsStreamLoader::OnStopRequest  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp, line 120]
nsJARChannel::OnStopRequest  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/modules/libjar/nsJARChannel.cpp, line 719]
Version: unspecified → Trunk
This regressed between yesterdays nightly and todays. 20051228->20051229
Component: General → Bookmarks
Summary: Crash @ nsXULElement::GetAttrNameAt with CTRL+B → Crash @ nsXULElement::GetAttrNameAt with CTRL+B & Manage Bookmarks
A possible cause for the regression could be the checkin for bug 284950.
*** Bug 321812 has been marked as a duplicate of this bug. ***
Very likely a regression of bug 284950.
Assignee: nobody → general
Blocks: 284950
Component: Bookmarks → DOM: Core
Product: Firefox → Core
QA Contact: general → ian
Severity: major → critical
Keywords: crash
regressionwindow
works 20051228 0609pst
fails 20051228 1717pst

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&filetype=match&whotype=match&sortby=Date&hours=2&date=explicit&mindate=20051228+0500&maxdate=20051228+1700&cvsroot=%2Fcvsroot
Summary: Crash @ nsXULElement::GetAttrNameAt with CTRL+B & Manage Bookmarks → Crash with CTRL+B & Manage Bookmarks [@ nsXULElement::GetAttrNameAt]
Not a dupe/manifestation of bug 232639?
Seems like nsXULElement::GetAttrNameAt is not out-of-bounds safe, so this is sort of a manifestation of bug 232639 exposed by the patch in 284950.

Taking
Assignee: general → bugmail
*** Bug 321844 has been marked as a duplicate of this bug. ***
SeaMonkey 1.5a build 1229210 on Mac OS X 10.3.9 also crashes when bookmarks opened in sidebar or from Manage Bookmarks  TB13397841G
Setting All/All as happens on Mac and Linux platforms too.
OS: Windows XP → All
Hardware: PC → All
*** Bug 321902 has been marked as a duplicate of this bug. ***
This should be fixed with the patch in bug 232639. Please reopen if that's not the case
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
*** Bug 321982 has been marked as a duplicate of this bug. ***
*** Bug 321993 has been marked as a duplicate of this bug. ***
*** Bug 322065 has been marked as a duplicate of this bug. ***
*** Bug 322125 has been marked as a duplicate of this bug. ***
Verified FIXED using both trunk SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Mozilla/1.0 and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Firefox/1.6a1
Status: RESOLVED → VERIFIED
Component: DOM: Core → DOM: Core & HTML
QA Contact: ian → general
Crash Signature: [@ nsXULElement::GetAttrNameAt]
You need to log in before you can comment on or make changes to this bug.