The default bug view has changed. See this FAQ.

Inserting invalid xbl:handler into a content document causes issues

RESOLVED FIXED in mozilla13

Status

()

Core
XBL
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: cesar, Assigned: Neil Deakin)

Tracking

unspecified
mozilla13
x86
Windows 7
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

5 years ago
Created attachment 591855 [details]
The xbl file

If the xbl:handler is missing the event attribute, when it gets inserted into an HTML document it causes a crash. This has to be regular HTML pages. The problem does not seem to occur on chrome documents such as about:config.

STR
1. Load a HTML document such as google.com
2. Call nsIDocument.ForceEnableXULXBL() (I had to this from a binary extension). Not sure how I can put this into a testcase
3. Insert the attached xbl file into the document.

Results:
Crash :(
(Reporter)

Comment 1

5 years ago
Created attachment 591856 [details]
Stacktrace from VS

aAtom is null near the top of the stack
(Assignee)

Comment 2

5 years ago
Can you be more specific by what you are doing here? What do you mean 'insert'? Insert using appendChild? or set a moz-binding property to the binding? If a testcase isn't feasible can you at least attach the code being used and when it crashes?
(Reporter)

Comment 3

5 years ago
(In reply to Neil Deakin from comment #2)
> Can you be more specific by what you are doing here? What do you mean
> 'insert'? Insert using appendChild? or set a moz-binding property to the
> binding? If a testcase isn't feasible can you at least attach the code being
> used and when it crashes?

Sorry, should have been more clear on that last step. By 'insert' I mean doing the following:

var d = document.createElementNS( "http://www.w3.org/1999/xhtml", "div");
d.style.setProperty("-moz-binding", "url(chrome://smartswipe-limited/content/topbar2.xml#topbar2)", "");
document.body.appendChild(d);

Where the url() is the path to the xbl attached above. It crashes immediately after appendChild is called.
(Assignee)

Comment 4

5 years ago
Created attachment 593089 [details] [diff] [review]
patch
Assignee: nobody → enndeakin
Status: NEW → ASSIGNED
(Assignee)

Updated

5 years ago
Attachment #593089 - Flags: review?(bzbarsky)
Comment on attachment 593089 [details] [diff] [review]
patch

r=me
Attachment #593089 - Flags: review?(bzbarsky) → review+
https://hg.mozilla.org/mozilla-central/rev/862dec07105b
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla13
(Assignee)

Updated

5 years ago
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.