421366 - crash when i make clic in one link... line 119: 9084 Segmentation fault [@ nsContentUtils::IsEventAttributeName]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Pablo Cholaky]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4pre) Gecko/2008030300 (Gentoo) Firefox/3.0b4pre
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b4pre) Gecko/2008030300 (Gentoo) Firefox/3.0b4pre

/usr/libexec/mozilla-launcher: line 119:  9084 Segmentation fault      $(type -P aoss) "$mozbin" $xulparams "$@"
xulrunner-bin exited with non-zero status (139)

When i make clic in one link... firefox closes himself with this error :S

Reproducible: Always

Steps to Reproduce:
1.Visit www.sii.cl
2.Make click in one link
Actual Results:  
Firefox Closes himself

Expected Results:  
See other web

Im using gentoo with kernel 2.6.24-r3

Xulruner 1.9_pre20080228 from mozilla svn
Firefox 20080303 from mozilla svn

Comment 1

[Jan Darmochwal]

I can confirm this bug, Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b5pre) Gecko/2008030715 Firefox/3.0b5pre.

Stack trace:
#0  0xb4b3d624 in nsContentUtils::IsEventAttributeName
      (aName=0x8b32080, aType=1)
    at mozilla/content/base/src/nsContentUtils.cpp:2857
#1  0xb4c3d9cb in nsGenericHTMLElement::AfterSetAttr
      (this=0x87606a0, aNamespaceID=0, aName=0x8b32080, aValue=0x0, aNotify=0)
    at mozilla/content/html/content/src/nsGenericHTMLElement.cpp:1331
#2  0xb4b99602 in nsGenericElement::UnsetAttr
      (this=0x87606a0, aNameSpaceID=0, aName=0x8b32080, aNotify=0)
    at mozilla/content/base/src/nsGenericElement.cpp:4044
#3  0xb4c4156c in nsGenericHTMLElement::UnsetAttr
      (this=0x87606a0, aNameSpaceID=0, aAttribute=0x8b32080, aNotify=0)
    at mozilla/content/html/content/src/nsGenericHTMLElement.cpp:1433
#4  0xb4cd35c5 in nsHTMLDocument::OpenCommon
      (this=0x85a3800, aContentType=@0xbf8d6dcc, aReplace=0)
    at mozilla/content/html/document/src/nsHTMLDocument.cpp:2227
#5  0xb4cd3bd9 in nsHTMLDocument::Open
      (this=0x85a3800, aContentType=@0xbf8d6dcc, aReplace=0, aReturn=0xbf8d6dd8)
    at mozilla/content/html/document/src/nsHTMLDocument.cpp:2342
#6  0xb4ccb033 in nsHTMLDocument::Open
      (this=0x85a3800)
    at mozilla/content/html/document/src/nsHTMLDocument.cpp:2335
#7  0xb4cd1c1f in nsHTMLDocument::WriteCommon
      (this=0x85a3800, aText=@0xbf8d6e88, aNewlineTerminate=1)
    at mozilla/content/html/document/src/nsHTMLDocument.cpp:2443
#8  0xb4cd21b0 in nsHTMLDocument::ScriptWriteCommon
      (this=0x85a3800, aNewlineTerminate=1)
    at mozilla/content/html/document/src/nsHTMLDocument.cpp:2535
#9  0xb4cd235f in nsHTMLDocument::Writeln
      (this=0x85a3800)
    at mozilla/content/html/document/src/nsHTMLDocument.cpp:2569
...

Comment 2

[Jan Darmochwal]

Attachment: testcase

The html-element in the testcase has an xml:lang attribute. FF does not crash without that attribute.

Comment 3

[Pablo Cholaky]

Strange... tested today and not problem... but yesterday i cant use the web :S Firefox closed himself

So... Solved for now...

Comment 4

[Jan Darmochwal]

Reopening, still crashes here with nightly builds newer than 2007120404.

Comment 5

[Olli Pettay [:smaug]]

Attachment: proposed patch

nsGenericElement::RemoveAttribute already keeps things alive.

Comment 6

[Peter Van der Beken [:peterv]]

Comment on attachment 308327 [details] [diff] [review]
proposed patch

Ugh, that's fragile :-/. I wonder if it wouldn't make more sense to make UnsetAttr keep the strong reference. There's only a couple of UnsetAttr implementations that would need to keep the atom alive (nsGenericElement and nsXULElement?).

Comment 7

[Olli Pettay [:smaug]]

well, the patch makes callers to follow the common xpcom rule to keep objects alive.