Crash [@ JS_IsExceptionPending] modifying a live NodeList

RESOLVED FIXED in mozilla10

Status

()

Core
DOM
--
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Jesse Ruderman, Assigned: peterv)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla10
x86_64
Mac OS X
crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox10-)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

6 years ago
Created attachment 569887 [details]
testcase (crashes Firefox when loaded)
(Reporter)

Comment 1

6 years ago
Created attachment 569888 [details]
stack trace (debug)

(Opt: bp-e8b730d4-a820-409a-ad90-ccfae2111026)

Comment 2

6 years ago
HTMLOptionsCollectionWrapper::setItemAt has:

  return NS_SUCCEEDED(rv) ? true : Throw(nsnull, rv);

but Throw() does XPCThrower::Throw(rv, cx); which does JS_IsExceptionPending(cx) which dereferences cx.

Peter, can we just pass in a JSContext to setItemAt?  The only caller seems to have a JSContext.
tracking-firefox10: --- → ?
(Reporter)

Comment 3

6 years ago
http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/src/dombindingsgen.py#144 ?

Comment 4

6 years ago
That's what generates the code in question, yes.
(Assignee)

Comment 5

6 years ago
Created attachment 570078 [details] [diff] [review]
v1
Assignee: nobody → peterv
Status: NEW → ASSIGNED
(Assignee)

Comment 6

6 years ago
Comment on attachment 570078 [details] [diff] [review]
v1

Ideally we'd throw when unwrapping, for that we should probably sprinkle more builtinclass around. But we need to deal correctly with errors from setItemAt anyway.
Attachment #570078 - Flags: review?(bzbarsky)

Comment 7

6 years ago
Comment on attachment 570078 [details] [diff] [review]
v1

r=me
Attachment #570078 - Flags: review?(bzbarsky) → review+
(Assignee)

Comment 8

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/7ab4f0ac68dd
Target Milestone: --- → mozilla10
https://hg.mozilla.org/mozilla-central/rev/7ab4f0ac68dd
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Updated

6 years ago
tracking-firefox10: ? → -
You need to log in before you can comment on or make changes to this bug.