Closed Bug 404548 Opened 12 years ago Closed 12 years ago

[FIX]ASSERTION: nsVoidArray::ElementAt: index out of range with iframes and field removing element

Categories

(Core :: DOM: Navigation, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla1.9beta2

People

(Reporter: martijn.martijn, Assigned: bzbarsky)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase
See testcase, I get this assertion when reloading the testcase in current debug trunk build:
###!!! ASSERTION: nsVoidArray::ElementAt: index out of range: '0 <= aIndex && aI
ndex < Count()', file c:\mozilla-build\mozilla\xpcom\glue\nsVoidArray.h, line 81

The iframe with the xul document src has only a window element with this binding:
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="a">
<implementation>
<field name="_field">window.frameElement.parentNode.removeChild(window.frameElement)</field>
<destructor>
  this._field = this;
</destructor>
</implementation>
</binding>
</bindings>
(so that's why I guess this is an xbl bug, but I might be wrong)
The stacktrace from the assertion is this:
 	ntdll.dll!_DbgBreakPoint@0() 	
>	xpcom_core.dll!Break(const char * aMsg=0x0012ef80)  Line 480	C++
 	xpcom_core.dll!NS_DebugBreak_P(unsigned int aSeverity=1, const char * aStr=0x0034b214, const char * aExpr=0x0034b1b0, const char * aFile=0x0034b1d8, int aLine=81)  Line 358 + 0xc bytes	C++
 	xpcom_core.dll!nsVoidArray::ElementAt(int aIndex=1)  Line 81 + 0x2b bytes	C++
 	xpcom_core.dll!nsVoidArray::operator[](int aIndex=1)  Line 96 + 0x13 bytes	C++
 	docshell.dll!nsDocLoader::ChildAt(int i=1)  Line 143	C++
 	docshell.dll!nsDocShell::FirePageHideNotification(int aIsUnload=1)  Line 992 + 0x12 bytes	C++
 	docshell.dll!nsDocShell::CreateContentViewer(const char * aContentType=0x07939030, nsIRequest * request=0x0766bf88, nsIStreamListener * * aContentHandler=0x065031f8)  Line 5894	C++
 	docshell.dll!nsDSURIContentListener::DoContent(const char * aContentType=0x07939030, int aIsContentPreferred=0, nsIRequest * request=0x0766bf88, nsIStreamListener * * aContentHandler=0x065031f8, int * aAbortProcess=0x0012f538)  Line 138 + 0x20 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::TryContentListener(nsIURIContentListener * aListener=0x0643eff8, nsIChannel * aChannel=0x0766bf88)  Line 735 + 0x41 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::DispatchContent(nsIRequest * request=0x0766bf88, nsISupports * aCtxt=0x00000000)  Line 434 + 0x39 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::OnStartRequest(nsIRequest * request=0x0766bf88, nsISupports * aCtxt=0x00000000)  Line 280 + 0x10 bytes	C++
 	necko.dll!nsBaseChannel::OnStartRequest(nsIRequest * request=0x068afbc8, nsISupports * ctxt=0x00000000)  Line 604 + 0x46 bytes	C++
 	necko.dll!nsInputStreamPump::OnStateStart()  Line 439 + 0x2c bytes	C++
 	necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream * stream=0x076a3790)  Line 395 + 0xb bytes	C++
 	xpcom_core.dll!nsInputStreamReadyEvent::Run()  Line 112	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f984)  Line 491	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x00e2bf50, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 154 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 170 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x00e28768, const nsXREAppData * aAppData=0x00e28b48)  Line 3142 + 0x25 bytes	C++
 	firefox.exe!main(int argc=1, char * * argv=0x00e28768)  Line 153 + 0x12 bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 586 + 0x19 bytes	C
 	firefox.exe!mainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes	
Not an XBL issue.  The patch will include a testcase that uses pagehide events in a similar way.
Component: XBL → Embedding: Docshell
OS: Windows XP → All
QA Contact: xbl → docshell
Hardware: PC → All
Attached patch Possible fixSplinter Review
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Attachment #289521 - Flags: superreview?
Attachment #289521 - Flags: review?
Summary: ASSERTION: nsVoidArray::ElementAt: index out of range with iframes and field removing element → [FIX]ASSERTION: nsVoidArray::ElementAt: index out of range with iframes and field removing element
Target Milestone: --- → mozilla1.9 M10
Attachment #289521 - Flags: superreview?(jst)
Attachment #289521 - Flags: superreview?
Attachment #289521 - Flags: review?(jst)
Attachment #289521 - Flags: review?
Attachment #289521 - Flags: superreview?(jst)
Attachment #289521 - Flags: superreview+
Attachment #289521 - Flags: review?(jst)
Attachment #289521 - Flags: review+
Comment on attachment 289521 [details] [diff] [review]
Possible fix

Just makes sure we don't walk off the end of the array here...
Attachment #289521 - Flags: approval1.9?
Attachment #289521 - Flags: approval1.9? → approval1.9+
Fixed, with test.
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.