Crash using schema and "0.5 RC" xpi on branch

RESOLVED FIXED

Status

--
critical
RESOLVED FIXED
13 years ago
2 years ago

People

(Reporter: allan, Assigned: allan)

Tracking

({crash, fixed1.8.1, verified1.8.0.4})

1.8 Branch
crash, fixed1.8.1, verified1.8.0.4

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

1.45 KB, application/xhtml+xml
Details
3.96 KB, application/xhtml+xml
Details
Fix
1.07 KB, patch
smaug
: review+
doronr
: review+
Details | Diff | Splinter Review
(Assignee)

Comment 1

13 years ago
Created attachment 217545 [details]
Testcase

This crashes on load for me. I cannot get it to crash on trunk or branch debug builds.

Comment 2

13 years ago
Comment on attachment 217545 [details]
Testcase

you mean xhtml I think :)
Attachment #217545 - Attachment is patch: false
Attachment #217545 - Attachment mime type: text/plain → application/xhtml+xml

Comment 3

13 years ago
Weird.  Doesn't happen with my latest 1.8.0 branch opt build, but I can reproduce with the 1.5.0.2 build.

The xforms and schemavalidation so files are the same size and all.

The only schema loader patch that is in 1.8.0.3 adn not 1.8.0.2 is https://bugzilla.mozilla.org/show_bug.cgi?id=329970, which is code that wouldn't fix a crasher (and in a different code path)

Comment 4

13 years ago
I am pulling the 1.5.0.2 rc2 branch and will build it debug
(Assignee)

Comment 5

13 years ago
Created attachment 217575 [details]
Crashes too

This one crashes too on load, and does not use schema directly...

Comment 6

13 years ago
1.5.0.2 branch, copied over schema validation and xforms from 1.8.0 branch, built, and I crash in the 2nd testcase:

#6  0x05b01c46 in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#7  0x05b0495b in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#8  0x05b04d3d in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#9  0x05b04dc1 in nsCreateInstanceByContractID::nsCreateInstanceByContractID () from /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/obj-debug/dist/bin/extensions/{cf2812dc-6a7c-4402-b639-4d277dac4c36}/components/libxforms.so
#10 0x0197267d in nsEventListenerManager::HandleEventSubType (this=0xa4b21e0, aListenerStruct=0xa4a0b08, aDOMEvent=0xa4accb0, aCurrentTarget=0xa4a32d0, aSubType=0, aPhaseFlags=7) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventListenerManager.cpp:1684
#11 0x01973ded in nsEventListenerManager::HandleEvent (this=0xa4b21e0, aPresContext=0xa2cd1b8, aEvent=0xa4accf0, aDOMEvent=0xbf9dbfe8, aCurrentTarget=0xa4a32d0, aFlags=7, aEventStatus=0xbf9dbfb4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventListenerManager.cpp:1785
#12 0x0191e377 in nsDocument::HandleDOMEvent (this=0xa4a3220, aPresContext=0xa2cd1b8, aEvent=0xa4accf0, aDOMEvent=0xbf9dbfe8, aFlags=Variable "aFlags" is not available.
) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:4048
#13 0x01978e03 in nsEventStateManager::DispatchNewEvent (this=0xa4f94d8, aTarget=0xa4a32a0, aEvent=0xa4accb0, aDefaultActionEnabled=0xbf9dc0e4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/events/src/nsEventStateManager.cpp:4583
#14 0x01920a66 in nsDocument::DispatchEvent (this=0xa4a3220, aEvent=0xa4accb0, _retval=0xbf9dc0e4) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:4143
#15 0x01923ea0 in nsDocument::DispatchContentLoadedEvents (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:2244
#16 0x019244db in nsDocument::EndLoad (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/base/src/nsDocument.cpp:2353
#17 0x019f6e37 in nsHTMLDocument::EndLoad (this=0xa4a3220) at /home/doron/mozbuilds/firefox-1.8.0.2/mozilla/content/html/document/src/nsHTMLDocument.cpp:990

Comment 7

13 years ago
If I take the 1.5.0.2 branch and apply the Patch for 1.8.0 branch patch in bug 332853, I get the same crash.
(Assignee)

Comment 8

13 years ago
The problem is that in nsXFormsModelElement::ValidateDocument() the call aInstanceDocument->GetDocumentElement() might return a null nsIDOMElement, even on success.

(damn, I remember sooo clearly looking at that line while reviewing and thinking "on success I guess there's no need for checking the element state" doh!)
(Assignee)

Comment 9

13 years ago
Created attachment 217831 [details] [diff] [review]
Fix
Assignee: aaronr → allan
Status: NEW → ASSIGNED
Attachment #217831 - Flags: review?(Olli.Pettay)

Updated

13 years ago
Attachment #217831 - Flags: review?(Olli.Pettay) → review+
(Assignee)

Updated

13 years ago
Attachment #217831 - Flags: review?(doronr)

Updated

13 years ago
Attachment #217831 - Flags: review?(doronr) → review+
(Assignee)

Comment 10

13 years ago
Checked in to trunk, 1_8_0, and 1_8
Status: ASSIGNED → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED

Updated

13 years ago
Keywords: fixed1.8.0.3, fixed1.8.1
(Assignee)

Updated

13 years ago
Depends on: 334007
verified on the 1.8.0.4 branch using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060504 Firefox/1.5.0.4. No crash using the Testcase or the Crashes too attachment. Adding keyword.
Keywords: fixed1.8.0.4 → verified1.8.0.4
Keywords: crash
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.