397304 - Crash [@ nsListBoxBodyFrame::GetAvailableHeight] with fake listboxbody

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Loading the testcase crashes Firefox.

Comment 1

[Jesse Ruderman]

The frame constructor checks for a tag name "listboxbody" without checking for a XUL namespace:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/layout/base/nsCSSFrameConstructor.cpp&rev=1.1402#5959

Is that the only problem, or would there still be a way to crash if that were fixed?

Comment 2

[Boris Zbarsky [:bzbarsky]]

That would still be a problem.  You could have "naked" XUL listboxbody like this and it would crash.  You could stick it in a grid with unscrollable overflow, and it would crash.  Etc, etc.

nsListBoxBodyFrame::GetAvailableHeight needs to null-check the return value of nsLayoutUtils::GetScrollableFrameFor like the other callers in that file, imo.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: null check scrollFrame

Like this. Handling namespaces properly in CSSFC is a different bug.
I noticed there are several cases where namespace should be checked but
it isn't.

Comment 4

[Jesse Ruderman]

Crashtest checked in.