471416 - Crash [@ nsXBLPrototypeBinding::AttributeChanged][@ nsXULElement::UnsetAttr][@ nsXULDocument::CheckBroadcasterHookup] with menulist, observes and acceltext

Status: VERIFIED FIXED

(Core :: XUL, defect, P2)

Description

[Martijn Wargers (dead)]

See testcase, which crashes current trunk build after 100ms.
It doesn't crash in a 2008-12-03 build, it does crash in a 2008-12-04 build:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2008-12-03+04%3A00%3A00&enddate=2008-12-04+06%3A00%3A00

Perhaps this is related to bug 470687, because it has the same regression range?

http://crash-stats.mozilla.com/report/index/baf37f75-2c72-442c-9240-db26f2081229
0  	xul.dll  	nsXBLPrototypeBinding::AttributeChanged  	 content/xbl/src/nsXBLPrototypeBinding.cpp:640
1 		@0x6a3460f

http://crash-stats.mozilla.com/report/index/3976c67f-9e55-4922-a6ae-f5c1a2081229?p=1
0  	xul.dll  	nsXULElement::UnsetAttr  	 content/xul/content/src/nsXULElement.cpp:1267
1 	xul.dll 	nsMenuFrame::BuildAcceleratorText 	layout/xul/base/src/nsMenuFrame.cpp:1022
2 	xul.dll 	xul.dll@0x2d3619 	
3 	xul.dll 	nsCSSFrameConstructor::AttributeChanged 	layout/base/nsCSSFrameConstructor.cpp:10109
4 	xul.dll 	PresShell::AttributeChanged 	layout/base/nsPresShell.cpp:4641
5 	xul.dll 	nsNodeUtils::AttributeChanged 	content/base/src/nsNodeUtils.cpp:110
6 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.cpp:4332
7 	xul.dll 	nsGenericElement::SetAttr 	content/base/src/nsGenericElement.cpp:4263
8 	xul.dll 	nsAString_internal::Assign 	xpcom/string/src/nsTSubstring.cpp:411
9 	xul.dll 	nsNodeUtils::AttributeChanged 	content/base/src/nsNodeUtils.cpp:110
10 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.cpp:4332

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: testcase2

Another one. This one has this breakpad stack:
http://crash-stats.mozilla.com/report/index/cff0bce1-fb70-4beb-9869-1ac4b2081229?p=1
0  	xul.dll  	nsXULDocument::CheckBroadcasterHookup  	 content/xul/document/src/nsXULDocument.cpp:4326
1 	xul.dll 	nsXULDocument::AttributeChanged 	content/xul/document/src/nsXULDocument.cpp:1049
2 	xul.dll 	SearchTable 	obj-firefox/xpcom/build/pldhash.c:423
3 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.cpp:4332
4 	xul.dll 	nsGenericElement::SetAttr 	content/base/src/nsGenericElement.cpp:4263
5 	xul.dll 	nsCOMPtr<nsIDOMDocumentView>::~nsCOMPtr<nsIDOMDocumentView> 	
6 	xul.dll 	nsXBLPrototypeBinding::AttributeChanged 	content/xbl/src/nsXBLPrototypeBinding.cpp:603
7 	xul.dll 	nsGenericElement::SetAttrAndNotify 	content/base/src/nsGenericElement.

Comment 3

[Martijn Wargers (dead)]

Also crashes in 1.9.1 trunk.

Comment 4

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090108 Minefield/3.2a1pre

Comment 5

[Marcia Knous [:marcia]]

Verified fixed on the 1.9.1 branch using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b4pre) Gecko/20090312 Shiretoko/3.1b4pre

Comment 7

[Firefox Bug Husbandry Bot]

Moving to Core:XUL per https://bugzilla.mozilla.org/show_bug.cgi?id=1455336