492286 - Crash [@ nsHTMLSourceElement::BindToTree] with source element as root

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, which crashes current trunk on load.

http://crash-stats.mozilla.com/report/index/99776527-717b-44f7-b38f-514a32090510?p=1
0  	xul.dll  	nsHTMLSourceElement::BindToTree  	 content/html/content/src/nsHTMLSourceElement.cpp:148
1 	xul.dll 	nsGenericElement::doInsertChildAt 	content/base/src/nsGenericElement.cpp:3278
2 	xul.dll 	nsDocument::InsertChildAt 	content/base/src/nsDocument.cpp:3229
3 	xul.dll 	xul.dll@0x9003ff 	
4 	xul.dll 	nsXMLContentSink::HandleStartElement 	content/xml/document/src/nsXMLContentSink.cpp:1102
5 	xul.dll 	storeAtts 	parser/expat/lib/xmlparse.c:3112
6 	xul.dll 	doContent 	parser/expat/lib/xmlparse.c:2439

Comment 2

[Daniel Veditz [:dveditz]]

We don't need to block on this, but the analysis in bug 515781 comment 1 makes it sound easy enough to fix.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Let's fix this.

Comment 4

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch v1 with crashtest

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Pushed to m-c: http://hg.mozilla.org/mozilla-central/rev/c02db2f94dce

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 402195 [details] [diff] [review]
Patch v1 with crashtest

Can I have approval for this on 1.9.2? It's a very simple crasher fix.

Comment 7

[Chris Pearce [:cpearce (Not reading bugmail)]]

Pushed to 1.9.2: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/68d563dd8cf6

Comment 8

[Tony Chung [:tchung]]

Verified fix on Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2b1pre) Gecko/20091008 Namoroka/3.6b1pre and Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2b1pre) Gecko/20091008 Namoroka/3.6b1pre
also Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.3a1pre) Gecko/20091008 Minefield/3.7a1pre

Comment 9

[Daniel Veditz [:dveditz]]

I don't see any instances of this crash in the last 3 weeks, it's probably not worth fixing this on the 1.9.1 branch.