83363 - crash if insertNode tries to add non-existent node

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Dylan Schiemann]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9+) Gecko/20010525
BuildID:    2001052504

Using the DOM 2 Range insertNode method, mozilla crashes if the node which is
being inserted does not exist.  I would think an exception should be raised, but
I don't see one in the spec.

Reproducible: Always
Steps to Reproduce:
1. run testcase
2. browser crashes

Actual Results:  Crash

Expected Results:  Exception or script error

Comment 1

[Dylan Schiemann]

Attachment: testcase

Comment 2

[Dylan Schiemann]

Attachment: testcase - crashes mozilla

Comment 3

[Dylan Schiemann]

I've added two testcase... one with a try catch statement and one without.  The
one with the try-catch does not crash, while the one without crashes my machine.
 I'm not sure where to draw the line between what the developer should check for
and what the browser should check for, but since this is a fundamental part of
the spec. and it seems that there will be many accidental cases of trying to add
a nonexistent node, then maybe it should throw an exception.

Comment 4

[lchiang]

I'm going to change the severity to critical since this is a crash bug report.

Comment 5

[anthonyd]

on it, i missed this. sorry.

anthonyd

Comment 6

[Dylan Schiemann]

Also crashes if the node to insert is already a descendant of the Range as well,
so it may crash upon any of the exceptions when not using try catch.

Comment 7

[anthonyd]

i have a fix for this, need to patch it up and get it attached here.
anthonyd

Comment 8

[anthonyd]

im attaching a patch for this, it is only a one liner, the rest of the patch is 
just other fixes for range that are descreibed in other bugs, and I didnt feel 
like breaking out just one line.  I will however paste it here:
nsRange::InsertNode line 1757:
  NS_ENSURE_ARG_POINTER(aN);

Comment 9

[anthonyd]

Attachment: patch

Comment 10

[anthonyd]

got an r= from mjudge, and a sr= from kin.

sending to [e-mail] for approval to check in.

anthonyd

Comment 11

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the trunk.
(on behalf of drivers)

Comment 12

[anthonyd]

fix checked in
anthonyd

Comment 13

[rubydoo123]

catching up on verifications