Closed Bug 333113 Opened 15 years ago Closed 15 years ago

Crash using schema and "0.5 RC" xpi on branch

Categories

(Core Graveyard :: XForms, defect)

1.8 Branch
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: allan, Assigned: allan)

References

Details

(Keywords: crash, fixed1.8.1, verified1.8.0.4)

Attachments

(3 files)

1.45 KB, application/xhtml+xml
Details
3.96 KB, application/xhtml+xml
Details
Fix
1.07 KB, patch
smaug
: review+
doronr
: review+
Details | Diff | Splinter Review
Attached file Testcase
This crashes on load for me. I cannot get it to crash on trunk or branch debug builds.
Comment on attachment 217545 [details]
Testcase

you mean xhtml I think :)
Attachment #217545 - Attachment is patch: false
Attachment #217545 - Attachment mime type: text/plain → application/xhtml+xml
Weird.  Doesn't happen with my latest 1.8.0 branch opt build, but I can reproduce with the 1.5.0.2 build.

The xforms and schemavalidation so files are the same size and all.

The only schema loader patch that is in 1.8.0.3 adn not 1.8.0.2 is https://bugzilla.mozilla.org/show_bug.cgi?id=329970, which is code that wouldn't fix a crasher (and in a different code path)
I am pulling the 1.5.0.2 rc2 branch and will build it debug
Attached file Crashes too
This one crashes too on load, and does not use schema directly...
1.5.0.2 branch, copied over schema validation and xforms from 1.8.0 branch, built, and I crash in the 2nd testcase:

#6  0x05b01c46 in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#7  0x05b0495b in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#8  0x05b04d3d in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#9  0x05b04dc1 in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#10 0x0197267d in nsEventListenerManager::HandleEventSubType (this=0xa4b21e0, aListenerStruct=0xa4a0b08, aDOMEvent=0xa4accb0, aCurrentTarget=0xa4a32d0, aSubType=0, aPhaseFlags=7) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventListenerManager.cpp:1684
#11 0x01973ded in nsEventListenerManager::HandleEvent (this=0xa4b21e0, aPresContext=0xa2cd1b8, aEvent=0xa4accf0, aDOMEvent=0xbf9dbfe8, aCurrentTarget=0xa4a32d0, aFlags=7, aEventStatus=0xbf9dbfb4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventListenerManager.cpp:1785
#12 0x0191e377 in nsDocument::HandleDOMEvent (this=0xa4a3220, aPresContext=0xa2cd1b8, aEvent=0xa4accf0, aDOMEvent=0xbf9dbfe8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:4048
#13 0x01978e03 in nsEventStateManager::DispatchNewEvent (this=0xa4f94d8, aTarget=0xa4a32a0, aEvent=0xa4accb0, aDefaultActionEnabled=0xbf9dc0e4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventStateManager.cpp:4583
#14 0x01920a66 in nsDocument::DispatchEvent (this=0xa4a3220, aEvent=0xa4accb0, _retval=0xbf9dc0e4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:4143
#15 0x01923ea0 in nsDocument::DispatchContentLoadedEvents (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:2244
#16 0x019244db in nsDocument::EndLoad (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:2353
#17 0x019f6e37 in nsHTMLDocument::EndLoad (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/html/document/src/nsHTMLDocument.cpp:990
If I take the 1.5.0.2 branch and apply the Patch for 1.8.0 branch patch in bug 332853, I get the same crash.
The problem is that in nsXFormsModelElement::ValidateDocument() the call aInstanceDocument->GetDocumentElement() might return a null nsIDOMElement, even on success.

(damn, I remember sooo clearly looking at that line while reviewing and thinking "on success I guess there's no need for checking the element state" doh!)
Attached patch FixSplinter Review
Assignee: aaronr → allan
Status: NEW → ASSIGNED
Attachment #217831 - Flags: review?(Olli.Pettay)
Attachment #217831 - Flags: review?(Olli.Pettay) → review+
Attachment #217831 - Flags: review?(doronr)
Attachment #217831 - Flags: review?(doronr) → review+
Checked in to trunk, 1_8_0, and 1_8
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Depends on: 334007
verified on the 1.8.0.4 branch using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060504 Firefox/1.5.0.4. No crash using the Testcase or the Crashes too attachment. Adding keyword.
Keywords: crash
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.