Closed Bug 344996 Opened 18 years ago Closed 18 years ago

"ASSERTION: Already have a document. Unbind first!" involving <img src="javascript:...">

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
PowerPC
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Assigned: bzbarsky)

References

Details

(Keywords: assertion, testcase, Whiteboard: post 1.8-branch)

Attachments

(1 file)

testcase
730 bytes, application/xhtml+xml
Details 
###!!! ASSERTION: Already have a document.  Unbind first!: '!GetCurrentDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 1842

###!!! ASSERTION: Already have a document.  Unbind first!: '!GetCurrentDoc() && !IsInDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 616

Filing as security-sensitive because this indicates that JavaScript is executing at an "unsafe time", and I don't know how "unsafe" that is.
Attached file testcase — 

    
    

    
  
Btw, this assertion also showed up in bug 343951 -- another example of scripts executing at an "unsafe time" and confusing the DOM.

    
  
Depends on: 351633

    
    

    
  
Checkin for bug 351633 fixed this.
Assignee: nobody → bzbarsky

    
  
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Whiteboard: post 1.8-branch
Group: security

    
    

    
  
Crashtest checked in.
Flags: in-testsuite+

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: