378521 - Crash [@ nsCSSFrameConstructor::CreateInputFrame] with <binding extends="html:input">

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading this testcase in Firefox (Mac trunk nightly) causes a null deref crash [@ nsCSSFrameConstructor::CreateInputFrame].

On trunk, at least, it might be best to fix this by removing support for extends="tagname" (bug 378518).

Comment 1

[Xanthor Sccas]

Crash also on GNU/Linux with Sm trunk.

Comment 2

[Jesse Ruderman]

Still crashes on trunk with the same crash signature.  Before the crash, there's also an assertion:

###!!! ASSERTION: input is not an nsIFormControl!: 'control', file /Users/jruderman/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 2323

Bug 378518 is blocking1.9+, so this bug should go away soon.

Comment 3

[Jesse Ruderman]

Now I just get

###!!! ASSERTION: Invalid extends value: 'Error', file /Users/jruderman/central/content/xbl/src/nsXBLService.cpp, line 989

I checked the testcase in as a crashtest and filed bug 454029 on the bogus assertion.

Comment 4

[Bob Clary [:bc] (inactive)]

1.9.0 !exploitable report
PROBABLY_EXPLOITABLE: Probably Exploitable - Data from Faulting Address controls Code Flow starting at gklayout!nsCSSFrameConstructor::CreateInputFrame

Comment 5

[Daniel Veditz [:dveditz]]

This is an unexploitable null-deref, !exploitable's paranoia interacts badly with this code pattern.