723676 - Firefox crashing when applying XBL with empty method

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[Gleb M. Borisov]

Attachment: XPI with test case. Press CrashMe to reproduce

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.77 Safari/535.7

Steps to reproduce:

Attaching XBL via elem.style.MozBinding = 'url(...)'


Actual results:

Firefox Crash


Expected results:

XBL should be attached

Comment 1

[Gleb M. Borisov]

Attachment: Testcase sources

Check case1.xul to see how XBL is applied and case1.xml to see XBL itself. Browser is crashing while loading XBL document.

Comment 2

[Gleb M. Borisov]

This issue is similiar to 199851, but I think a lot of things changed since 2003.

Comment 3

[Josh Matthews [:jdm]]

Can you provide a link to the corresponding crash report from about:crashes?

Comment 4

[Gleb M. Borisov]

Yep, of course: https://crash-stats.mozilla.com/report/index/bp-4c224926-f9c9-4228-b188-281302120202

Comment 5

[Boris Zbarsky [:bzbarsky]]

This looks like a null-deref crash due to XBL fastload.  Are we trying to write out a null function object or something?

Comment 6

[Neil Deakin]

Attachment: null check for method

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 595501 [details] [diff] [review]
null check for method

r=me

Comment 8

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/a98cf6ce2f0a