double free / crash involving XUL templates [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]

RESOLVED FIXED

Status

()

Core
XUL
--
critical
RESOLVED FIXED
12 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: Neil Deakin)

Tracking

(Depends on: 1 bug, Blocks: 1 bug, {crash, regression, testcase})

Trunk
PowerPC
Mac OS X
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
wanted1.8.1.x -
wanted1.8.0.x -
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical] 1.9+ only, crash signature)

Attachments

(3 attachments)

(Reporter)

Description

12 years ago
 
(Reporter)

Comment 1

12 years ago
Created attachment 214536 [details]
testcase

Load in a *debug build* of Firefox to see double-free messages and crash.
(Reporter)

Comment 2

12 years ago
Created attachment 214537 [details]
double-free messages and crash stack traces
(Reporter)

Updated

12 years ago
Flags: blocking1.9a1?
Summary: double free / crash involving XUL templates → double free / crash involving XUL templates [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]
Whiteboard: [sg:critical]
(Reporter)

Comment 3

12 years ago
Oops, this crashes release builds too.  It's a regression from bug 329335 and I was testing a too-old release build.
Blocks: 329335
Keywords: regression
(Assignee)

Comment 4

12 years ago
Created attachment 214560 [details] [diff] [review]
add a kungFuDeathGrip just like DocumentWillBeDestroyed

Also, fix the silly mistake in the call to the SetTemplateBuilderFor
Attachment #214560 - Flags: superreview?(bzbarsky)
Attachment #214560 - Flags: review?(bzbarsky)
Comment on attachment 214560 [details] [diff] [review]
add a kungFuDeathGrip just like DocumentWillBeDestroyed

Doh.  Should have caught that.  :(
Attachment #214560 - Flags: superreview?(bzbarsky)
Attachment #214560 - Flags: superreview+
Attachment #214560 - Flags: review?(bzbarsky)
Attachment #214560 - Flags: review+
(Assignee)

Updated

12 years ago
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Whiteboard: [sg:critical] → [sg:critical] 1.9+ only
Flags: blocking1.9a1?
Group: security
Flags: wanted1.8.1.x-
Flags: wanted1.8.0.x-
(Reporter)

Comment 6

11 years ago
Crashtest checked in.
Flags: in-testsuite+

Updated

10 years ago
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
Crash Signature: [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]
Depends on: 742682
Assignee: nobody → enndeakin
Crash Signature: [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget] → [@ nsXULTemplateBuilder::ContentRemoved] [@ nsDOMEventRTTearoff::GetDOM3EventTarget]
You need to log in before you can comment on or make changes to this bug.