333113 - Crash using schema and "0.5 RC" xpi on branch

Status: RESOLVED FIXED

(Core Graveyard :: XForms, defect)

Description

[Allan Beaufour]

Using the 1.5.0.2 and the nightlies of xforms.xpi, I have a crasher.

I'm using:
ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.8.0/linux-xpi/xforms.xpi
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/1.5.0.2-candidates/firefox-1.5.0.2.en-US.linux-i686.tar.gz

Using a clean profile.

Comment 1

[Allan Beaufour]

Attachment: Testcase

This crashes on load for me. I cannot get it to crash on trunk or branch debug builds.

Comment 2

[Doron Rosenberg (IBM)]

Comment on attachment 217545 [details]
Testcase

you mean xhtml I think :)

Comment 3

[Doron Rosenberg (IBM)]

Weird.  Doesn't happen with my latest 1.8.0 branch opt build, but I can reproduce with the 1.5.0.2 build.

The xforms and schemavalidation so files are the same size and all.

The only schema loader patch that is in 1.8.0.3 adn not 1.8.0.2 is https://bugzilla.mozilla.org/show_bug.cgi?id=329970, which is code that wouldn't fix a crasher (and in a different code path)

Comment 4

[Doron Rosenberg (IBM)]

I am pulling the 1.5.0.2 rc2 branch and will build it debug

Comment 5

[Allan Beaufour]

Attachment: Crashes too

This one crashes too on load, and does not use schema directly...

Comment 6

[Doron Rosenberg (IBM)]

1.5.0.2 branch, copied over schema validation and xforms from 1.8.0 branch, built, and I crash in the 2nd testcase:

#6  0x05b01c46 in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#7  0x05b0495b in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#8  0x05b04d3d in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#9  0x05b04dc1 in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#10 0x0197267d in nsEventListenerManager::HandleEventSubType (this=0xa4b21e0, aListenerStruct=0xa4a0b08, aDOMEvent=0xa4accb0, aCurrentTarget=0xa4a32d0, aSubType=0, aPhaseFlags=7) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventListenerManager.cpp:1684
#11 0x01973ded in nsEventListenerManager::HandleEvent (this=0xa4b21e0, aPresContext=0xa2cd1b8, aEvent=0xa4accf0, aDOMEvent=0xbf9dbfe8, aCurrentTarget=0xa4a32d0, aFlags=7, aEventStatus=0xbf9dbfb4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventListenerManager.cpp:1785
#12 0x0191e377 in nsDocument::HandleDOMEvent (this=0xa4a3220, aPresContext=0xa2cd1b8, aEvent=0xa4accf0, aDOMEvent=0xbf9dbfe8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:4048
#13 0x01978e03 in nsEventStateManager::DispatchNewEvent (this=0xa4f94d8, aTarget=0xa4a32a0, aEvent=0xa4accb0, aDefaultActionEnabled=0xbf9dc0e4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventStateManager.cpp:4583
#14 0x01920a66 in nsDocument::DispatchEvent (this=0xa4a3220, aEvent=0xa4accb0, _retval=0xbf9dc0e4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:4143
#15 0x01923ea0 in nsDocument::DispatchContentLoadedEvents (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:2244
#16 0x019244db in nsDocument::EndLoad (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:2353
#17 0x019f6e37 in nsHTMLDocument::EndLoad (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/html/document/src/nsHTMLDocument.cpp:990

Comment 7

[Doron Rosenberg (IBM)]

If I take the 1.5.0.2 branch and apply the Patch for 1.8.0 branch patch in bug 332853, I get the same crash.

Comment 8

[Allan Beaufour]

The problem is that in nsXFormsModelElement::ValidateDocument() the call aInstanceDocument->GetDocumentElement() might return a null nsIDOMElement, even on success.

(damn, I remember sooo clearly looking at that line while reviewing and thinking "on success I guess there's no need for checking the element state" doh!)

Comment 9

[Allan Beaufour]

Attachment: Fix

Comment 10

[Allan Beaufour]

Checked in to trunk, 1_8_0, and 1_8

Comment 11

[Marcia Knous [:marcia]]

verified on the 1.8.0.4 branch using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060504 Firefox/1.5.0.4. No crash using the Testcase or the Crashes too attachment. Adding keyword.