Crash [@ nsBoxObject::RemoveProperty] passing undefined

VERIFIED FIXED

Status

()

Core
DOM
--
critical
VERIFIED FIXED
12 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: smaug)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
PowerPC
Mac OS X
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

12 years ago
Similar to bug 346083, but for RemoveProperty.
(Reporter)

Comment 1

12 years ago
Created attachment 231092 [details]
testcase
Created attachment 231094 [details] [diff] [review]
null checks etc.

Fixes also few other possible problems in the same file;
makes sure that return value is set nsnull in few cases.
Assignee: general → Olli.Pettay
Status: NEW → ASSIGNED
Attachment #231094 - Flags: superreview?(bzbarsky)
Attachment #231094 - Flags: review?(bzbarsky)
Attachment #231094 - Flags: superreview?(bzbarsky)
Attachment #231094 - Flags: superreview+
Attachment #231094 - Flags: review?(bzbarsky)
Attachment #231094 - Flags: review+
(Assignee)

Updated

12 years ago
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Verified FIXED using the testcase of https://bugzilla.mozilla.org/attachment.cgi?id=231092&action=view with build 2006-07-30-08 of SeaMonkey trunk in Windows XP.
Status: RESOLVED → VERIFIED
(Reporter)

Comment 4

11 years ago
I checked in a crashtest a few days ago.
Flags: in-testsuite+
Crash Signature: [@ nsBoxObject::RemoveProperty]
Component: DOM: Mozilla Extensions → DOM
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.