Closed Bug 650501 Opened 14 years ago Closed 14 years ago

Crash [@ nsScriptElement::MaybeProcessScript] with several innerHTML sets

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla6
Tracking Flags:
Tracking Status
firefox5 --- fixed

People

(Reporter: jruderman, Assigned: hsivonen)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(3 files)

testcase (crashes Firefox when loaded)
371 bytes, application/xhtml+xml
Details
stack trace (mac debug)
12.00 KB, text/plain
Details
Add a null check
2.65 KB, patch
smaug
: review+
jst
: approval-mozilla-aurora+
Details | Diff | Splinter Review 
Crash [@ nsScriptElement::MaybeProcessScript]

The code that's crashing was added in bug 592366:
http://hg.mozilla.org/mozilla-central/annotate/b140e7746652/content/base/src/nsScriptElement.cpp#l172

    
    

    
  
Needs more null checking.
Assignee: nobody → hsivonen
Status: NEW → ASSIGNED

    
    

    
  

      
      
      
      

        Attached patch
          
          
        Add a null check
        — 
          — Splinter Review
      

    


  
This code was written with HTML in mind. Yay for XML code paths. :-(

That we come to this branch at all is bogus. Will fix properly in bug 563322.

        Attachment #526706 -
        Flags: review?(Olli.Pettay)

        Attachment #526706 -
        Flags: review?(Olli.Pettay) → review+

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/2648367a59f0
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED

    
    

    
  
Comment on attachment 526706 [details] [diff] [review]
Add a null check

This is a stability fix that simply adds a null check. Seems to fit the Aurora criteria, so nominating.

        Attachment #526706 -
        Flags: approval-mozilla-aurora?

    
  
OS: Mac OS X → All
Hardware: x86 → All

        Attachment #526706 -
        Flags: approval-mozilla-aurora? → approval-mozilla-aurora+

    
    

    
  
http://hg.mozilla.org/mozilla-aurora/rev/759590bbd0c9

          status-firefox5:
          --- → fixed
Target Milestone: --- → mozilla6
Crash Signature: [@ nsScriptElement::MaybeProcessScript]
Component: DOM → DOM: Core & HTML

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: