344939 - Template crashes with javascript nsIXULTemplateResult implementation

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Pawel Chmielowski]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060715 Firefox/3.0a1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060715 Firefox/3.0a1

Template code cast objects from nsISimpleEnumerator instead calling QI on its. This causes crashes when used with XPConnect wrappers.

Reproducible: Always

Comment 1

[Pawel Chmielowski]

Attachment: v1

This patch fixes this problem for me.

Comment 2

[Neil Deakin]

Comment on attachment 229487 [details] [diff] [review]
v1

OK, but please also change the similar call in nsXULTreeBuilder::OpenSubtreeForQuerySet

Comment 3

[Pawel Chmielowski]

Attachment: v2

This adds similar change to nsXULTreeBuilder::OpenSubtreeForQuerySet

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 229501 [details] [diff] [review]
v2

>Index: content/xul/templates/src/nsXULContentBuilder.cpp
>+        nsCOMPtr<nsIXULTemplateResult> nextresult = do_QueryInterface(nr, &rv);

Why bother with rv if you don't use it?

Same in the other spot.

sr=bzbarsky with that fixed.

Please let me know if you need this checked in, ok?

Comment 5

[Pawel Chmielowski]

Attachment: v3

Review comment fixes.

I will very appreciate if you could check it in.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Checked in.  Thanks for the fix!

Comment 7

[[e-mail]]

Why does class nsGetterAddRefs<T> have an nsISupports**() operator anyway?

Comment 8

[Boris Zbarsky [:bzbarsky]]

Good question!  Worth filing a bug on XPCOM over, maybe (and ccing dbaron and biesi).