Last Comment Bug 721452 - Inserting invalid xbl:handler into a content document causes issues
: Inserting invalid xbl:handler into a content document causes issues
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: XBL (show other bugs)
: unspecified
: x86 Windows 7
: -- normal (vote)
: mozilla13
Assigned To: Neil Deakin
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-26 10:42 PST by Cesar Oliveira [:cesar]
Modified: 2012-02-14 05:20 PST (History)
3 users (show)
enndeakin: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
The xbl file (349 bytes, text/plain)
2012-01-26 10:42 PST, Cesar Oliveira [:cesar]
no flags Details
Stacktrace from VS (7.38 KB, text/plain)
2012-01-26 10:45 PST, Cesar Oliveira [:cesar]
no flags Details
patch (2.40 KB, patch)
2012-01-31 07:28 PST, Neil Deakin
bzbarsky: review+
Details | Diff | Review

Description Cesar Oliveira [:cesar] 2012-01-26 10:42:42 PST
Created attachment 591855 [details]
The xbl file

If the xbl:handler is missing the event attribute, when it gets inserted into an HTML document it causes a crash. This has to be regular HTML pages. The problem does not seem to occur on chrome documents such as about:config.

STR
1. Load a HTML document such as google.com
2. Call nsIDocument.ForceEnableXULXBL() (I had to this from a binary extension). Not sure how I can put this into a testcase
3. Insert the attached xbl file into the document.

Results:
Crash :(
Comment 1 Cesar Oliveira [:cesar] 2012-01-26 10:45:47 PST
Created attachment 591856 [details]
Stacktrace from VS

aAtom is null near the top of the stack
Comment 2 Neil Deakin 2012-01-26 12:55:20 PST
Can you be more specific by what you are doing here? What do you mean 'insert'? Insert using appendChild? or set a moz-binding property to the binding? If a testcase isn't feasible can you at least attach the code being used and when it crashes?
Comment 3 Cesar Oliveira [:cesar] 2012-01-26 13:23:56 PST
(In reply to Neil Deakin from comment #2)
> Can you be more specific by what you are doing here? What do you mean
> 'insert'? Insert using appendChild? or set a moz-binding property to the
> binding? If a testcase isn't feasible can you at least attach the code being
> used and when it crashes?

Sorry, should have been more clear on that last step. By 'insert' I mean doing the following:

var d = document.createElementNS( "http://www.w3.org/1999/xhtml", "div");
d.style.setProperty("-moz-binding", "url(chrome://smartswipe-limited/content/topbar2.xml#topbar2)", "");
document.body.appendChild(d);

Where the url() is the path to the xbl attached above. It crashes immediately after appendChild is called.
Comment 4 Neil Deakin 2012-01-31 07:28:05 PST
Created attachment 593089 [details] [diff] [review]
patch
Comment 5 Boris Zbarsky [:bz] 2012-02-08 13:11:58 PST
Comment on attachment 593089 [details] [diff] [review]
patch

r=me
Comment 6 Marco Bonardo [::mak] 2012-02-14 02:26:21 PST
https://hg.mozilla.org/mozilla-central/rev/862dec07105b

Note You need to log in before you can comment on or make changes to this bug.