404548 - [FIX]ASSERTION: nsVoidArray::ElementAt: index out of range with iframes and field removing element

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, I get this assertion when reloading the testcase in current debug trunk build:
###!!! ASSERTION: nsVoidArray::ElementAt: index out of range: '0 <= aIndex && aI
ndex < Count()', file c:\mozilla-build\mozilla\xpcom\glue\nsVoidArray.h, line 81

The iframe with the xul document src has only a window element with this binding:
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="a">
<implementation>
<field name="_field">window.frameElement.parentNode.removeChild(window.frameElement)</field>
<destructor>
  this._field = this;
</destructor>
</implementation>
</binding>
</bindings>
(so that's why I guess this is an xbl bug, but I might be wrong)

Comment 1

[Martijn Wargers (dead)]

The stacktrace from the assertion is this:
 	ntdll.dll!_DbgBreakPoint@0() 	
>	xpcom_core.dll!Break(const char * aMsg=0x0012ef80)  Line 480	C++
 	xpcom_core.dll!NS_DebugBreak_P(unsigned int aSeverity=1, const char * aStr=0x0034b214, const char * aExpr=0x0034b1b0, const char * aFile=0x0034b1d8, int aLine=81)  Line 358 + 0xc bytes	C++
 	xpcom_core.dll!nsVoidArray::ElementAt(int aIndex=1)  Line 81 + 0x2b bytes	C++
 	xpcom_core.dll!nsVoidArray::operator[](int aIndex=1)  Line 96 + 0x13 bytes	C++
 	docshell.dll!nsDocLoader::ChildAt(int i=1)  Line 143	C++
 	docshell.dll!nsDocShell::FirePageHideNotification(int aIsUnload=1)  Line 992 + 0x12 bytes	C++
 	docshell.dll!nsDocShell::CreateContentViewer(const char * aContentType=0x07939030, nsIRequest * request=0x0766bf88, nsIStreamListener * * aContentHandler=0x065031f8)  Line 5894	C++
 	docshell.dll!nsDSURIContentListener::DoContent(const char * aContentType=0x07939030, int aIsContentPreferred=0, nsIRequest * request=0x0766bf88, nsIStreamListener * * aContentHandler=0x065031f8, int * aAbortProcess=0x0012f538)  Line 138 + 0x20 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::TryContentListener(nsIURIContentListener * aListener=0x0643eff8, nsIChannel * aChannel=0x0766bf88)  Line 735 + 0x41 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::DispatchContent(nsIRequest * request=0x0766bf88, nsISupports * aCtxt=0x00000000)  Line 434 + 0x39 bytes	C++
 	docshell.dll!nsDocumentOpenInfo::OnStartRequest(nsIRequest * request=0x0766bf88, nsISupports * aCtxt=0x00000000)  Line 280 + 0x10 bytes	C++
 	necko.dll!nsBaseChannel::OnStartRequest(nsIRequest * request=0x068afbc8, nsISupports * ctxt=0x00000000)  Line 604 + 0x46 bytes	C++
 	necko.dll!nsInputStreamPump::OnStateStart()  Line 439 + 0x2c bytes	C++
 	necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream * stream=0x076a3790)  Line 395 + 0xb bytes	C++
 	xpcom_core.dll!nsInputStreamReadyEvent::Run()  Line 112	C++
 	xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012f984)  Line 491	C++
 	xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x00e2bf50, int mayWait=1)  Line 227 + 0x16 bytes	C++
 	gkwidget.dll!nsBaseAppShell::Run()  Line 154 + 0xc bytes	C++
 	tkitcmps.dll!nsAppStartup::Run()  Line 170 + 0x1c bytes	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x00e28768, const nsXREAppData * aAppData=0x00e28b48)  Line 3142 + 0x25 bytes	C++
 	firefox.exe!main(int argc=1, char * * argv=0x00e28768)  Line 153 + 0x12 bytes	C++
 	firefox.exe!__tmainCRTStartup()  Line 586 + 0x19 bytes	C
 	firefox.exe!mainCRTStartup()  Line 403	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes	

Comment 2

[Boris Zbarsky [:bzbarsky]]

Not an XBL issue.  The patch will include a testcase that uses pagehide events in a similar way.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Possible fix

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 289521 [details] [diff] [review]
Possible fix

Just makes sure we don't walk off the end of the array here...

Comment 5

[Boris Zbarsky [:bzbarsky]]

Fixed, with test.