Inserting invalid xbl:handler into a content document causes issues

RESOLVED FIXED in mozilla13

Status

()

Core
XBL
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: cesar, Assigned: Neil Deakin (not available until Aug 9))

Tracking

unspecified
mozilla13
x86
Windows 7
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 591855 [details]
The xbl file

If the xbl:handler is missing the event attribute, when it gets inserted into an HTML document it causes a crash. This has to be regular HTML pages. The problem does not seem to occur on chrome documents such as about:config.

STR
1. Load a HTML document such as google.com
2. Call nsIDocument.ForceEnableXULXBL() (I had to this from a binary extension). Not sure how I can put this into a testcase
3. Insert the attached xbl file into the document.

Results:
Crash :(
(Reporter)

Comment 1

5 years ago
Created attachment 591856 [details]
Stacktrace from VS

aAtom is null near the top of the stack
Can you be more specific by what you are doing here? What do you mean 'insert'? Insert using appendChild? or set a moz-binding property to the binding? If a testcase isn't feasible can you at least attach the code being used and when it crashes?
(Reporter)

Comment 3

5 years ago
(In reply to Neil Deakin from comment #2)
> Can you be more specific by what you are doing here? What do you mean
> 'insert'? Insert using appendChild? or set a moz-binding property to the
> binding? If a testcase isn't feasible can you at least attach the code being
> used and when it crashes?

Sorry, should have been more clear on that last step. By 'insert' I mean doing the following:

var d = document.createElementNS( "http://www.w3.org/1999/xhtml", "div");
d.style.setProperty("-moz-binding", "url(chrome://smartswipe-limited/content/topbar2.xml#topbar2)", "");
document.body.appendChild(d);

Where the url() is the path to the xbl attached above. It crashes immediately after appendChild is called.
Created attachment 593089 [details] [diff] [review]
patch
Assignee: nobody → enndeakin
Status: NEW → ASSIGNED
Attachment #593089 - Flags: review?(bzbarsky)
Comment on attachment 593089 [details] [diff] [review]
patch

r=me
Attachment #593089 - Flags: review?(bzbarsky) → review+
https://hg.mozilla.org/mozilla-central/rev/862dec07105b
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla13
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.