165201 - Crash from composer exit dialog

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Tracy Walker [:tracy]]

seen on windows commercial trunk build 2002-08-28-04-trunk

-open a new composer window
-type in some text
-close the composer window
a dialog comes up asking to "Save" Don't Save" or "Cancle"
-Click any of the three buttons

Crash
 
talkback:
Incident ID 9987684
Stack Signature js_GC 59df9444
Email Address [e-mail]
Product ID MozillaTrunk
Build ID 2002082804
Trigger Time 2002-08-28 08:13:24
Platform Win32
Operating System Windows 98 4.10 build 67766446
Module JS3250.DLL
URL visited
User Comments crash clicking don't save in composer exit
Trigger Reason Access violation
Source File Name c:/builds/seamonkey/mozilla/js/src/jsgc.c
Trigger Line No. 1244
Stack Trace
js_GC [c:/builds/seamonkey/mozilla/js/src/jsgc.c, line 1244]
js_ForceGC [c:/builds/seamonkey/mozilla/js/src/jsgc.c, line 994]
js_DestroyContext [c:/builds/seamonkey/mozilla/js/src/jscntxt.c, line 243]
nsXPConnect::ReleaseJSContext
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 1079]
nsJSContext::`scalar deleting destructor'
nsCOMPtr_base::~nsCOMPtr_base
[c:/builds/seamonkey/mozilla/xpcom/glue/nsCOMPtr.cpp, line 65]
GlobalWindowImpl::RunTimeout
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 4733]
KERNEL32.DLL + 0xb9c5 (0xbff7b9c5)
0x04650000

Comment 1

[Kathleen :Brade]

-->brendan
I think this is due to brendan's checkin (since there were no checkins to
mozilla/editor and talkback is crashing on a line that brendan touched)

Comment 2

[Kathleen :Brade]

By the way, the "Revert" dialog also crashes upon dismissal
(open an existing page, make a change, choose File > Revert to Last Saved)

Comment 3

[Kathleen :Brade]

I'm guessing this is a regression caused by fix for bug 164697.

Comment 4

[serge (gone)]

yes, this is definitely a regression, i just back out brendan's checkins and
crash is gone.

Comment 5

[Brendan Eich [:brendan]]

Very sorry about that, I should have seen the problem.  I #if 0'd out the bad
new code; I'll come up with a better fix soon.

/be

Comment 6

[serge (gone)]

it's not a blocker anymore changing severity to critical.

Comment 7

[Brendan Eich [:brendan]]

serge, please don't reset my priority and TM settings.

/be

Comment 8

[serge (gone)]

I did not reset priority & TM, I've changed only severity, because after your
#if 0 checkins it's not a blocker anymore, please correct me if I'm wrong.

Comment 9

[R.K.Aa.]

*** Bug 165397 has been marked as a duplicate of this bug. ***

Comment 10

[R.K.Aa.]

dup on Linux TB10028407M TB10028362G. OS: All.

Comment 11

[Tracy Walker [:tracy]]

marking fixed as seen on commercial trunk builds:

windows 2002-08-29-04-trunk
linux 2002-08-29-04-trunk
mac os9 2002-08-29-03-trunk

please verify.

Comment 12

[Tracy Walker [:tracy]]

verified on sujays request

Comment 13

[Brendan Eich [:brendan]]

Will you guys (serge and tracy at least) please let me mark my bug fixed, and
set its priority and target milestone.  (Serge, please click on View Bug
Activity to see what you did).  I wanted this bug left open to track a better
fix than #if 0'ing out some code.

/be

Comment 14

[serge (gone)]

hmm, brendan I swear I did change only severity, that's probably buglilla glitch,
what was the reason for me to change TM or priority?

Comment 15

[Brendan Eich [:brendan]]

Moving out, some of these may move to 1.3alpha shortly.

/be

Comment 16

[Brendan Eich [:brendan]]

Fixing TM.

/be

Comment 17

[Phil Schwartau]

Brendan noted the following issue in bug 178389 comment 19,
which will be taken care of here:


------- Additional Comment_ #19 From Brendan Eich 2002-12-21 20:21 ------- 

Note that if RegExp.prototype.toSource is overridden, a dual of this bug will
bite.  I'd like to fix that under bug 165201, so no need to file a new bug --
feel free to note the bug there, or to file a dependent bug.

/be

Comment 18

[Phil Schwartau]

Brendan showed me how the above issue arises:

---------------- DEFINE FUNCTION CONTAINING REGEXP LITERAL ----------------
js> function f() { return /abc/; }
js> f.toSource()
function f() {return /abc/;}
js> f.toString()

function f() {
    return /abc/;
}

---------------- NOW OVERRIDE RegExp.prototype.toSource ----------------
js> RegExp.prototype.toSource = function() { return 'Hi there'; }

js> f.toSource()
function f() {return Hi there;}
js> f.toString()

function f() {
    return Hi there;
}


---------------- COMPARE: NO SUCH PROBLEM WITH ARRAYS ----------------
js> function g() { return [1,2,3]; }
js> g.toSource();
function g() {return [1, 2, 3];}
js> g.toString();

function g() {
    return [1, 2, 3];
}

js> Array.prototype.toSource = function() { return 'Hi there'; }

js> g.toSource();
function g() {return [1, 2, 3];}
js> g.toString();

function g() {
    return [1, 2, 3];
}

Comment 19

[Brendan Eich [:brendan]]

Bump.

/be

Comment 20

[Anders Pedersen]

WFM.

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7b) Gecko/20040331
Microsoft Windows 2000 Professional 5.00.2195 SP4

Comment 21

[Brendan Eich [:brendan]]

No longer a crash bug.

/be

Comment 22

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 23

[Bob Clary [:bc] (inactive)]

js/tests/js1_5/Regress/regress-165201.js checked in.

Comment 24

[Bob Clary [:bc] (inactive)]

verified fixed 1.8.x and trunk.