Closed
Bug 620181
Opened 14 years ago
Closed 14 years ago
crash [@ nsXBLPrototypeBinding::LocateInstance] if the while loop condition becomes false
Categories
(Core :: XBL, defect)
Core
XBL
Tracking
()
RESOLVED
FIXED
mozilla5
People
(Reporter: timeless, Assigned: timeless)
References
(Blocks 1 open bug)
Details
(Keywords: coverity, crash)
Crash Data
Attachments
(1 file)
|
769 bytes,
patch
|
neil
:
review+
jst
:
approval2.0-
|
Details | Diff | Splinter Review |
848 nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
891 while (binding) {
892 anonContent = binding->GetAnonymousContent();
893 if (anonContent)
894 break;
895
896 binding = binding->GetBaseBinding();
897 }
if we actually exit the while loop based on the loop condition, we'll crash
900 if (anonContent == copyParent)
901 binding->GetInsertionPointsFor(aBoundElement, &points);
902 else
903 binding->GetInsertionPointsFor(copyParent, &points);
Assignee: nobody → timeless
Status: NEW → ASSIGNED
Attachment #498575 -
Flags: review?(neil)
Attachment #498575 -
Flags: approval2.0?
|
||
Updated•14 years ago
|
Attachment #498575 -
Flags: review?(neil) → review+
|
||
Comment 2•14 years ago
|
||
Comment on attachment 498575 [details] [diff] [review]
patch
Mass minusing patch approval that don't have high return. Please renominate if this is more important for 2.0 than it appears.
Attachment #498575 -
Flags: approval2.0? → approval2.0-
|
||
Comment 3•14 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.2
|
||
Updated•14 years ago
|
Crash Signature: [@ nsXBLPrototypeBinding::LocateInstance]
|
||
Updated•7 years ago
|
Blocks: coverity-analysis
You need to log in
before you can comment on or make changes to this bug.
Description
•