Closed Bug 620181 Opened 9 years ago Closed 9 years ago

crash [@ nsXBLPrototypeBinding::LocateInstance] if the while loop condition becomes false

Categories

(Core :: XBL, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla5

People

(Reporter: timeless, Assigned: timeless)

References

(Blocks 1 open bug)

Details

(Keywords: coverity, crash)

Crash Data

Attachments

(1 file)

848 nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,

891     while (binding) {
892       anonContent = binding->GetAnonymousContent();
893       if (anonContent)
894         break;
895 
896       binding = binding->GetBaseBinding();
897     }

if we actually exit the while loop based on the loop condition, we'll crash

900     if (anonContent == copyParent)
901       binding->GetInsertionPointsFor(aBoundElement, &points);
902     else
903       binding->GetInsertionPointsFor(copyParent, &points);
Attached patch patchSplinter Review
Assignee: nobody → timeless
Status: NEW → ASSIGNED
Attachment #498575 - Flags: review?(neil)
Attachment #498575 - Flags: approval2.0?
Attachment #498575 - Flags: review?(neil) → review+
Comment on attachment 498575 [details] [diff] [review]
patch

Mass minusing patch approval that don't have high return. Please renominate if this is more important for 2.0 than it appears.
Attachment #498575 - Flags: approval2.0? → approval2.0-
http://hg.mozilla.org/mozilla-central/rev/b15c571ae66f
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.2
Crash Signature: [@ nsXBLPrototypeBinding::LocateInstance]
You need to log in before you can comment on or make changes to this bug.