Closed Bug 329884 Opened 19 years ago Closed 19 years ago

double free / crash involving XUL templates [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]

Categories

(Core :: XUL, defect)

PowerPC
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: enndeakin)

References

(Depends on 1 open bug)

Details

(Keywords: crash, regression, testcase, Whiteboard: [sg:critical] 1.9+ only)

Crash Data

Attachments

(3 files)

Attached file testcase
Load in a *debug build* of Firefox to see double-free messages and crash.
Flags: blocking1.9a1?
Summary: double free / crash involving XUL templates → double free / crash involving XUL templates [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]
Whiteboard: [sg:critical]
Oops, this crashes release builds too. It's a regression from bug 329335 and I was testing a too-old release build.
Blocks: 329335
Keywords: regression
Also, fix the silly mistake in the call to the SetTemplateBuilderFor
Attachment #214560 - Flags: superreview?(bzbarsky)
Attachment #214560 - Flags: review?(bzbarsky)
Comment on attachment 214560 [details] [diff] [review] add a kungFuDeathGrip just like DocumentWillBeDestroyed Doh. Should have caught that. :(
Attachment #214560 - Flags: superreview?(bzbarsky)
Attachment #214560 - Flags: superreview+
Attachment #214560 - Flags: review?(bzbarsky)
Attachment #214560 - Flags: review+
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
Whiteboard: [sg:critical] → [sg:critical] 1.9+ only
Flags: blocking1.9a1?
Group: security
Flags: wanted1.8.1.x-
Flags: wanted1.8.0.x-
Crashtest checked in.
Flags: in-testsuite+
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
Crash Signature: [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]
Depends on: 742682
Assignee: nobody → enndeakin
Crash Signature: [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget] → [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: