39744 - crash in xbl, doing something with compose

Status: VERIFIED FIXED

(MailNews Core :: Composition, defect, P3)

Description

[(not reading, please use [e-mail] instead)]

here's the crash:

nsXBLService::GetContentList(nsXBLService * const 0x02a6b030, nsIContent * 
0x059b2720, nsISupportsArray * * 0x0012ed44, nsIContent * * 0x0012ed58) line 
299 + 38 bytes
nsXULElement::GetAnonymousContent(nsXULElement * const 0x059b272c, 
nsIDOMNodeList * * 0x0012ed70) line 4268 + 78 bytes
GetXULElementProperty(JSContext * 0x05883640, JSObject * 0x05039890, long 
0xfffffff1, long * 0x0012f6a4) line 187 + 22 bytes
js_GetProperty(JSContext * 0x05883640, JSObject * 0x05039890, long 0x02f01670, 
long * 0x0012f6a4) line 1950 + 125 bytes
js_Interpret(JSContext * 0x05883640, long * 0x0012f82c) line 2343 + 1446 bytes
js_Invoke(JSContext * 0x05883640, unsigned int 0x00000003, unsigned int 
0x00000002) line 702 + 13 bytes
js_InternalInvoke(JSContext * 0x05883640, JSObject * 0x038e3518, long 
0x05039a20, unsigned int 0x00000000, unsigned int 0x00000003, long * 
0x04a835c0, long * 0x0012f964) line 775 + 19 bytes
JS_CallFunctionValue(JSContext * 0x05883640, JSObject * 0x038e3518, long 
0x05039a20, unsigned int 0x00000003, long * 0x04a835c0, long * 0x0012f964) line 
2783 + 31 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x05882a90, void * 
0x038e3518, void * 0x05039a20, unsigned int 0x00000003, void * 0x04a835c0, int 
* 0x0012f9ec, int 0x00000000) line 788 + 33 bytes
GlobalWindowImpl::RunTimeout(nsTimeoutImpl * 0x06475a90) line 3345 + 84 bytes
nsGlobalWindow_RunTimeout(nsITimer * 0x06475980, void * 0x06475a90) line 3591 + 
15 bytes
nsTimer::Fire() line 194 + 17 bytes
nsTimerManager::FireNextReadyTimer(nsTimerManager * const 0x010be1f0, unsigned 
int 0x00000000) line 117
FireTimeout(HWND__ * 0x00000000, unsigned int 0x00000113, unsigned int 
0x00002900, unsigned long 0x0523c547) line 89
USER32! 77e7185c()
nsAppShellService::Run(nsAppShellService * const 0x0106a4b0) line 372
main1(int 0x00000002, char * * 0x00c54bb0, nsISupports * 0x00000000) line 904 + 
32 bytes
main(int 0x00000002, char * * 0x00c54bb0) line 1187 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77f1ba06()

here's the patch:

Index: nsXBLService.cpp
===================================================================
RCS file: /cvsroot/mozilla/layout/xbl/src/nsXBLService.cpp,v
retrieving revision 1.36
diff -p -r1.36 nsXBLService.cpp
*** nsXBLService.cpp    2000/05/12 06:25:48     1.36
--- nsXBLService.cpp    2000/05/18 17:48:22
*************** nsXBLService::GetContentList(nsIContent*
*** 296,301 ****
--- 296,303 ----
    nsCOMPtr<nsIDocument> document;
    aContent->GetDocument(*getter_AddRefs(document));
    nsCOMPtr<nsIBindingManager> bindingManager;
+   NS_ASSERTION(document, "no document");
+   if (!document) return NS_ERROR_FAILURE;
    document->GetBindingManager(getter_AddRefs(bindingManager));

    nsCOMPtr<nsIXBLBinding> binding;

Comment 1

[(not reading, please use [e-mail] instead)]

hrm, maybe it wasn't a mailto link, but I was doing compose.

sorry I can't remember.

I'll work on reproducing.

in any case, document was null.

Comment 2

[David Hyatt]

your patch is good.  move it above the binding manager comptr decl.  kicking to 
you.

Comment 3

[(not reading, please use [e-mail] instead)]

thanks dave.  marking fixed.

Comment 4

[leger]

Adding crash keyword

Comment 5

[[e-mail] (gone - use [e-mail] instead)]

I haven't seen this in comm, opt (moz) or debug (moz), marking verified, fixed.