Closed Bug 417509 Opened 13 years ago Closed 13 years ago

Crash [@ nsCOMPtr_base::assign_with_AddRef] with moving node and datasources attribute on html element

Categories

(Core :: XUL, defect, P4)

x86
Windows XP
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: martijn.martijn, Assigned: martijn.martijn)

References

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(1 file)

625 bytes, application/vnd.mozilla.xul+xml
Details
See testcase, which normally crashes after a while after loading. Opening a different window, or switching focus seems to help triggering the crash.
There is some privileged code that could help crashing, in that case you need to download it to your computer.

http://crash-stats.mozilla.com/report/index/60075aa3-db17-11dc-ab5f-001a4bd43ed6
0  	nsCOMPtr_base::assign_with_AddRef(nsISupports*)  	 nsCOMPtr.cpp:88
1 	nsDocument::BeginUpdate(unsigned int) 	mozilla/content/base/src/nsDocument.cpp:2637
2 	nsEventStateManager::SetContentState(nsIContent*, int) 	mozilla/content/events/src/nsEventStateManager.cpp:4322
3 	nsEventStateManager::PostHandleEvent(nsPresContext*, nsEvent*, nsIFrame*, nsEventStatus*, nsIView*) 	mozilla/content/events/src/nsEventStateManager.cpp:2623
4 	PresShell::HandleEventInternal(nsEvent*, nsIView*, nsEventStatus*) 	mozilla/layout/base/nsPresShell.cpp:5861

This regressed between 2006-02-13 and 2006-02-19, and since the testcase looks similar to the one of bug 329335, I think this is a regression from bug 285631.

Given that this may not be fixed before Firefox 3 comes out, I'm marking this security sensitive.
Flags: blocking1.9?
Attached file testcase
Flags: blocking1.9? → blocking1.9+
Priority: -- → P4
Flags: wanted1.9.0.x+
Flags: blocking1.9-
Flags: tracking1.9+
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → WORKSFORME
Flags: in-testsuite?
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
Group: core-security
Flags: wanted1.9.0.x+ → wanted1.9.0.x-
Crash Signature: [@ nsCOMPtr_base::assign_with_AddRef]
Landed a crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e0dc666e2430
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.