697643 - Crash [@ JS_IsExceptionPending] modifying a live NodeList

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Comment 1

[Jesse Ruderman]

Attachment: stack trace (debug)

(Opt: bp-e8b730d4-a820-409a-ad90-ccfae2111026)

Comment 2

[Boris Zbarsky [:bzbarsky]]

HTMLOptionsCollectionWrapper::setItemAt has:

  return NS_SUCCEEDED(rv) ? true : Throw(nsnull, rv);

but Throw() does XPCThrower::Throw(rv, cx); which does JS_IsExceptionPending(cx) which dereferences cx.

Peter, can we just pass in a JSContext to setItemAt?  The only caller seems to have a JSContext.

Comment 3

[Jesse Ruderman]

http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/src/dombindingsgen.py#144 ?

Comment 4

[Boris Zbarsky [:bzbarsky]]

That's what generates the code in question, yes.

Comment 5

[Peter Van der Beken [:peterv]]

Attachment: v1

Comment 6

[Peter Van der Beken [:peterv]]

Comment on attachment 570078 [details] [diff] [review]
v1

Ideally we'd throw when unwrapping, for that we should probably sprinkle more builtinclass around. But we need to deal correctly with errors from setItemAt anyway.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 570078 [details] [diff] [review]
v1

r=me

Comment 8

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7ab4f0ac68dd

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7ab4f0ac68dd