434251 - Crash [@ nsAttrValue::ToString] with checkbox, command and doCommand

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk build within 100ms.

This regressed between 2007-09-01 and 2007-09-03:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-09-01+04&maxdate=2007-09-03+09&cvsroot=%2Fcvsroot
Not sure what bug is the culprit.

http://crash-stats.mozilla.com/report/index/bbf8b73d-235d-11dd-97e3-001a4bd46e84?p=1
0  	xul.dll  	nsAttrValue::ToString  	 mozilla/content/base/src/nsAttrValue.cpp:307
1 	xul.dll 	xul.dll@0x28dfc6 	

Stack trace from debug build:
>	xpcom_core.dll!AppendUTF8toUTF16(const nsACString_internal & aSource={...}, nsAString_internal & aDest={...})  Line 253 + 0x3 bytes	C++
 	xpcom_core.dll!CopyUTF8toUTF16(const nsACString_internal & aSource={...}, nsAString_internal & aDest={...})  Line 93 + 0xd bytes	C++
 	xpcom_core.dll!AtomImpl::ToString(nsAString_internal & aBuf={...})  Line 517 + 0x20 bytes	C++
 	gklayout.dll!nsAttrValue::ToString(nsAString_internal & aResult={...})  Line 325	C++
 	gklayout.dll!nsXULElement::GetAttr(int aNameSpaceID=0, nsIAtom * aName=0x012ce0a4, nsAString_internal & aResult={...})  Line 1250	C++
 	gklayout.dll!nsXULElement::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 1613	C++
 	gklayout.dll!nsEventTargetChainItem::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 186 + 0x1c bytes	C++
 	gklayout.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x065301a0, nsPresContext * aPresContext=0x036bf768, nsEvent * aEvent=0x00033548, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x00033590, nsDispatchingCallback * aCallback=0x00000000)  Line 442	C++
 	gklayout.dll!nsXULElement::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 1656 + 0x29 bytes	C++
 	gklayout.dll!nsEventTargetChainItem::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 186 + 0x1c bytes	C++
 	gklayout.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x065301a0, nsPresContext * aPresContext=0x036bf768, nsEvent * aEvent=0x00033748, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x00033790, nsDispatchingCallback * aCallback=0x00000000)  Line 442	C++
 	gklayout.dll!nsXULElement::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 1656 + 0x29 bytes	C++
 	gklayout.dll!nsEventTargetChainItem::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 186 + 0x1c bytes	C++
 	gklayout.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x065301a0, nsPresContext * aPresContext=0x036bf768, nsEvent * aEvent=0x00033948, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x00033990, nsDispatchingCallback * aCallback=0x00000000)  Line 442	C++
 	gklayout.dll!nsXULElement::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 1656 + 0x29 bytes	C++
 	gklayout.dll!nsEventTargetChainItem::PreHandleEvent(nsEventChainPreVisitor & aVisitor={...})  Line 186 + 0x1c bytes	C++
 	gklayout.dll!nsEventDispatcher::Dispatch(nsISupports * aTarget=0x065301a0, nsPresContext * aPresContext=0x036bf768, nsEvent * aEvent=0x00033b48, nsIDOMEvent * aDOMEvent=0x00000000, nsEventStatus * aEventStatus=0x00033b90, nsDispatchingCallback * aCallback=0x00000000)  Line 442	C++
etc... (keeps repeating)

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: add check for command event loop