Closed Bug 321810 Opened 19 years ago Closed 19 years ago

Crash with CTRL+B & Manage Bookmarks [@ nsXULElement::GetAttrNameAt]

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: u88484, Assigned: sicking)

References

(
URL
)

Details

(Keywords: crash, regression)

Crash Data

Firefox crashes when CTRL+B is pressed to open the Bookmarks in the sidebar. TB13378572Q Stack Signature nsXULElement::GetAttrNameAt ec84f072 Product ID FirefoxTrunk Build ID 2005122905 Trigger Time 2005-12-29 08:16:45.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module firefox.exe + (00192c83) URL visited User Comments Since Last Crash 13 sec Total Uptime 13 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1523 Stack Trace nsXULElement::GetAttrNameAt [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 1523] nsXULTemplateBuilder::CompileSimpleRule [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 2186] nsXULTemplateBuilder::CompileRules [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 1567] nsXULTreeBuilder::RebuildAll [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 1343] nsXULTemplateBuilder::Rebuild [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 244] nsXULTreeBuilder::SetTree [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTreeBuilder.cpp, line 835] nsTreeBodyFrame::SetView [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 571] nsTreeBodyFrame::EnsureView [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 461] nsTreeBodyFrame::GetMinSize [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp, line 261] nsBox::GetPrefSize [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 703] nsBox::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBox.cpp, line 781] nsSprocketLayout::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564] nsBoxFrame::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970] nsSprocketLayout::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564] nsBoxFrame::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970] nsSprocketLayout::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564] nsBoxFrame::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970] nsSprocketLayout::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564] nsBoxFrame::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970] nsSprocketLayout::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 1564] nsBoxFrame::GetAscent [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 970] nsSprocketLayout::Layout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsSprocketLayout.cpp, line 260] nsBoxFrame::DoLayout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1089] nsBoxFrame::DoLayout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1089] nsRootBoxFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsRootBoxFrame.cpp, line 215] nsContainerFrame::ReflowChild [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsContainerFrame.cpp, line 891] ViewportFrame::Reflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/generic/nsViewportFrame.cpp, line 230] PresShell::InitialReflow [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/layout/base/nsPresShell.cpp, line 2767] nsXULDocument::StartLayout [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 2106] nsXULDocument::ResumeWalk [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3146] nsXULDocument::OnStreamComplete [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3430] nsStreamLoader::OnStopRequest [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsStreamLoader.cpp, line 120] nsJARChannel::OnStopRequest [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/modules/libjar/nsJARChannel.cpp, line 719]
Version: unspecified → Trunk
This regressed between yesterdays nightly and todays. 20051228->20051229
Component: General → Bookmarks
Summary: Crash @ nsXULElement::GetAttrNameAt with CTRL+B → Crash @ nsXULElement::GetAttrNameAt with CTRL+B & Manage Bookmarks
A possible cause for the regression could be the checkin for bug 284950.
*** Bug 321812 has been marked as a duplicate of this bug. ***
Very likely a regression of bug 284950.
Assignee: nobody → general
Blocks: 284950
Component: Bookmarks → DOM: Core
Product: Firefox → Core
QA Contact: general → ian
Severity: major → critical
Keywords: crash
regressionwindow works 20051228 0609pst fails 20051228 1717pst http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=PhoenixTinderbox&branch=HEAD&branchtype=match&filetype=match&whotype=match&sortby=Date&hours=2&date=explicit&mindate=20051228+0500&maxdate=20051228+1700&cvsroot=%2Fcvsroot
Summary: Crash @ nsXULElement::GetAttrNameAt with CTRL+B & Manage Bookmarks → Crash with CTRL+B & Manage Bookmarks [@ nsXULElement::GetAttrNameAt]
Not a dupe/manifestation of bug 232639?
Seems like nsXULElement::GetAttrNameAt is not out-of-bounds safe, so this is sort of a manifestation of bug 232639 exposed by the patch in 284950. Taking
Assignee: general → bugmail
*** Bug 321844 has been marked as a duplicate of this bug. ***
SeaMonkey 1.5a build 1229210 on Mac OS X 10.3.9 also crashes when bookmarks opened in sidebar or from Manage Bookmarks TB13397841G
Setting All/All as happens on Mac and Linux platforms too.
OS: Windows XP → All
Hardware: PC → All
*** Bug 321902 has been marked as a duplicate of this bug. ***
This should be fixed with the patch in bug 232639. Please reopen if that's not the case
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
*** Bug 321982 has been marked as a duplicate of this bug. ***
*** Bug 321993 has been marked as a duplicate of this bug. ***
*** Bug 322065 has been marked as a duplicate of this bug. ***
*** Bug 322125 has been marked as a duplicate of this bug. ***
Verified FIXED using both trunk SeaMonkey 1.5a;Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Mozilla/1.0 and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060104 Firefox/1.6a1
Status: RESOLVED → VERIFIED
Component: DOM: Core → DOM: Core & HTML
QA Contact: ian → general
Crash Signature: [@ nsXULElement::GetAttrNameAt]
You need to log in before you can comment on or make changes to this bug.