468210 - [FIX]Crash [@ nsHTMLDocument::MatchAnchors] with XBL

Status: VERIFIED FIXED

(Core :: XBL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

MatchAnchors complains about two assertion failures, then dereferences null.

###!!! ASSERTION: This method should never be called on content nodes that are not in a document!: 'aContent->IsInDoc()', file /Users/jruderman/central/content/html/document/src/nsHTMLDocument.cpp, line 1675

###!!! ASSERTION: Huh, how did this happen? This should only be used with HTML documents!: 'htmldoc', file /Users/jruderman/central/content/html/document/src/nsHTMLDocument.cpp, line 1682

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed fix

Similar to bug 406900.  In this case we null out the binding parent of the anon content but not its content parent, which makes it think it's in the non-anonymous DOM, and then things go bad.

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 352062 [details] [diff] [review]
Proposed fix

Nice, I suspect this was the originally intended behavior with the existing |UnbindFromTree| call. I wonder if that is needed at all any more...

Comment 3

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/mozilla-central/rev/54aad068c46c

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 352062 [details] [diff] [review]
Proposed fix

I think we should take this on branches.

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 352062 [details] [diff] [review]
Proposed fix

a191=beltzner

Comment 6

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/releases/mozilla-1.9.1/rev/6fb499641030

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 352062 [details] [diff] [review]
Proposed fix

Approved for 1.9.0.6, a=dveditz for release-drivers.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed on 1.9.0.6.

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Running the attached testcase on 3.0.5 on OS X, I get no crash. Is this a crash in debug builds only?

Comment 10

[Boris Zbarsky [:bzbarsky]]

No, since it's a null-pointer dereference.  But the behavior will be gc-dependent and such, so if there was a change to that or to XBL unbinding since 1.9.0 it might require a slightly different testcase to trigger tehre.

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Yeah, it doesn't work on OS X and I checked on Linux too, just because.

Comment 12

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.9.1 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20090115 Shiretoko/3.1b3pr.

Comment 13

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Verified with:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre) Gecko/20090122 Minefield/3.2a1pre ID:20090122020333

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.6) Gecko/2009011912 Firefox/3.0.6