Crash when reading past the end of a CSSRuleList

RESOLVED FIXED in mozilla0.9

Status

()

Core
DOM: CSS Object Model
--
critical
RESOLVED FIXED
17 years ago
17 years ago

People

(Reporter: Hixie (not reading bugmail), Assigned: jst)

Tracking

({crash, dom2, testcase})

Trunk
mozilla0.9
crash, dom2, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [fix in hand], URL)

Attachments

(2 attachments)

(Reporter)

Description

17 years ago
STEPS TO REPRODUCE
   1. <style type="text/css"></style>
   2. document.styleSheets[0].cssRules[0];

ACTUAL RESULTS
   KABOOM!

See http://www.damowmow.com/mozilla/crash/8.html
(Reporter)

Updated

17 years ago
Keywords: crash, dom2, mozilla1.0, testcase

Comment 1

17 years ago
confirmed on mozilla0.8 windows95...
(Reporter)

Comment 2

17 years ago
http://www.damowmow.com/mozilla/crash/9.html shows this problem too, but, I 
think, because another bug is causing the array to be smaller than expected.

In other words: This problem is causing other problems to be more serious! :-)
(Reporter)

Comment 3

17 years ago
Created attachment 27768 [details] [diff] [review]
Patch: moves the NS_RELEASE(), and adds code to deal with the NS_ERROR_ILLEGAL_VALUE case
(Reporter)

Comment 4

17 years ago
The patch moves the NS_RELEASE() to inside the |if (result == NS_OK)| block,
since |rule| will only be allocated if |result| is |NS_OK|. This fixes the 
crash. The patch also adds an |else if| for the NS_ERROR_ILLEGAL_VALUE case,
so that we follow the DOM spec, which says to return null in that case.

Test case:
   http://www.damowmow.com/mozilla/crash/8.html

Looking for r=, sr=, and someone to check it in...
Keywords: patch
Whiteboard: [fix in hand]
(Reporter)

Comment 5

17 years ago
Created attachment 27769 [details] [diff] [review]
Patch: Switches to using nsCOMPtr instead of NS_RELEASE(), changes from QueryInterface to CallQueryInterface, and checks for |rule| instead of NS_OK.
(Reporter)

Comment 6

17 years ago
New patch, this time doing all the Right Things per jst. :-)

Once again looking for r=, sr=, and someone to check it in...
r=glazman ; tested on linux
(Assignee)

Comment 8

17 years ago
Thank you Hixie for the fix (and Daniel for the review), I'll land this once the
tree opens, sr=jst
Status: NEW → ASSIGNED
OS: Windows 2000 → All
Hardware: PC → All
Whiteboard: [fix in hand] → [HAVE FIX]
Target Milestone: --- → mozilla0.9
(Reporter)

Updated

17 years ago
Whiteboard: [HAVE FIX] → [fix in hand]

Comment 9

17 years ago
Fix checked in.
Status: ASSIGNED → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → FIXED
(Assignee)

Comment 10

17 years ago
*** Bug 73274 has been marked as a duplicate of this bug. ***
You need to log in before you can comment on or make changes to this bug.