76404 - crash opening view source when MOZ_VALIDATE_HTML is set

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Boris Zbarsky [:bzbarsky]]

BUILD: 2001-04-17-08

STEPS TO REPRODUCE:
1)  "setenv MOZ_VALIDATE_HTML 1" or equivalent
2)  Run mozilla
3)  open view source and crash

Here's what's going on:

We are using the parser context passed to CViewSourceHTML::WillBuildModel to
initialize mValidator
(http://lxr.mozilla.org/seamonkey/source/htmlparser/src/nsViewSourceHTML.cpp#439):

mValidator=aParserContext.mValidator;

The parser context gets its value of mValidator in 
http://lxr.mozilla.org/seamonkey/source/htmlparser/src/nsParser.cpp#1048 

The value is set in GetSharedObjects(), which just creates and returns a new
CSharedParserObjects object.  The constructor for this object does not set
mOtherDTD to null, and that pointer eventually becomes mValidator in view source
and is dereferenced, causing a segmentation violation.  Attaching a patch that
properly sets the pointer to null in the constructor

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: patch to fix this

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: another patch, moving the initializations to a better place

Comment 3

[timeless]

r=timeless

Comment 4

[Boris Zbarsky [:bzbarsky]]

The checkin for bug 69455 fixed this among other things.  The pointer is now
properly initialized in the constructor.  Marking fixed.

Comment 5

[bsharma]

Verified on:
build: 2001-05-21-11-Mtrunk
platform: WinNT

Marking it verified as per above developer comments.