34061 - nearly infinite loop in nsXULDocument::AddSubtreeToDocument() caused by nsXULElement::GetAttributeCount()

Status: RESOLVED FIXED

(SeaMonkey :: MailNews: Message Display, defect, P3)

Description

[(not reading, please use [e-mail] instead)]

I have a message (I'll attach the mbox format of it) that causes a nearly
infinite loop.

nsXULElement::GetAttributeCount() gets called, and we fall through with out
setting aResult, so it is left uninitialized.

in my case, that left it as 57775032, which means I spent a long time in the for
loop in AddSubtreeToDocument()

I've started a "patch" that prevents the infinite loop.  (It works for me.)
I'll attach the mbox of the evil message next.

Comment 1

[(not reading, please use [e-mail] instead)]

Attachment: here's a patch

Comment 2

[(not reading, please use [e-mail] instead)]

updating summary.

now to attach the evil message.

Comment 3

[(not reading, please use [e-mail] instead)]

Attachment: the evil message in a mbox folder

Comment 4

[Chris Waterson]

Attachment: nsXULElement::GetAttributeCount() is busted. here's a fix.

Comment 5

[Chris Waterson]

fix ready

Comment 6

[(not reading, please use [e-mail] instead)]

waterson, check that in.  r=sspitzer

Comment 7

[Jon Granrose]

a=granrose

Comment 8

[Chris Waterson]

fix checked in. update nsXULElement::GetAttributeCount().

Comment 9

[Kevin Puetz]

*** Bug 34080 has been marked as a duplicate of this bug. ***