174709 - Crash on Xopus demo for contenteditable [@ initScan]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[José Jeria]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2b) Gecko/20021013
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2b) Gecko/20021013

Go to 
http://xopus.org/demo/xopus/xopus.html?rnd=0.723197851915904#content=http%3A//xopus.org/demo/index.html

and click on "simple demo" --> crash

Talkback ID: TB12624430E

Reproducible: Always

Steps to Reproduce:

Comment 1

[Frederic Bezies]

Confirming bug, using tunk build 2002101504 - WinXP.

Sent talkback TB12627397Y

Comment 2

[Michael Hearn]

Lack of contentEditable is a known issue. Moz shouldn't crash on it, but as
support is currently in development this may be why.

Comment 3

[Michael Hearn]

Lack of contentEditable is a known issue. Moz shouldn't crash on it, but as
support is currently in development this may be why.

Comment 4

[greer]

cc'ing heikki and harishd. 
Harish, does this go to you?

Product ID  MozillaTrunk
Build ID 2002101308
Operating System Windows NT 5.0 build 2195
URL visited http://delete.me.uk/dom/07/

Stack Trace
initScan [c:/builds/seamonkey/mozilla/expat/xmltok/xmltok.c, line 1465]
initScanProlog [c:/builds/seamonkey/mozilla/expat/xmltok/xmltok_ns.c, line 39]
prologProcessor [c:/builds/seamonkey/mozilla/expat/xmlparse/xmlparse.c, line 2248]
prologInitProcessor [c:/builds/seamonkey/mozilla/expat/xmlparse/xmlparse.c, line
2238]
0x0012dcd4
nsExpatDriver::ParseBuffer
[c:/builds/seamonkey/mozilla/htmlparser/src/nsExpatDriver.cpp, line 758]
nsExpatDriver::ConsumeToken
[c:/builds/seamonkey/mozilla/htmlparser/src/nsExpatDriver.cpp, line 867]
nsParser::Tokenize [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp,
line 2528]
nsParser::ResumeParse [c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp,
line 1752]
nsParser::OnStopRequest
[c:/builds/seamonkey/mozilla/htmlparser/src/nsParser.cpp, line 2440]
nsDOMParser::ParseFromStream
[c:/builds/seamonkey/mozilla/extensions/xmlextras/base/src/nsDOMParser.cpp, line
661]
nsDOMParser::ParseFromString
[c:/builds/seamonkey/mozilla/extensions/xmlextras/base/src/nsDOMParser.cpp, line
468]
XPTC_InvokeByIndex
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 106]
XPCWrappedNative::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 1996]
XPC_WN_CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1267]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 841]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2804]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 857]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 932]
js_GetProperty [c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2549]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2640]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 857]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2417]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 857]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2804]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 857]
nsXPCWrappedJSClass::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1195]
nsXPCWrappedJS::CallMethod
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 430]
PrepareAndDispatch
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 117]
SharedStub
[c:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 139]
nsEventListenerManager::HandleEventSubType
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1187]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1866]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 770]
DocumentViewerImpl::LoadComplete
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 965]
nsDocShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4216]
nsWebShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp, line 814]
nsDocShell::OnStateChange
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4150]
nsDocLoaderImpl::FireOnStateChange
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 1218]
nsDocLoaderImpl::doStopDocumentLoad
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 870]
nsDocLoaderImpl::DocLoaderIsEmpty
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 768]
nsDocLoaderImpl::OnStopRequest
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 699]
nsLoadGroup::RemoveRequest
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 703]
PresShell::RemoveDummyLayoutRequest
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6728]
PresShell::ProcessReflowCommands
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6543]
PresShell::FlushPendingNotifications
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5177]
nsEventStateManager::FlushPendingEvents
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 4455]
nsEventStateManager::GenerateDragGesture
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 1459]
nsEventStateManager::PreHandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 402]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6215]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6143]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2200]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 304]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 1934]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 83]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1065]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1082]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5248]
ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5503]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 3969]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1331]
USER32.dll + 0x2a290 (0x77e3a290)
USER32.dll + 0x45b1 (0x77e145b1)
USER32.dll + 0x5b1d (0x77e15b1d)
nsAppShellService::Run
[c:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 472] 

Comment 5

[harishd]

assigning to myself. Heikki and I will work on it.

Comment 6

[harishd]

I'm using Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2b)
Gecko/20021016 but I don't see the crash. When I click on "simple demo" I get
the message " ...this editor hasn't started yet..." with the following
exception/error:

CSS Error (http://xopus.org/demo/demos/standard/index.html :1.433): Error in par
sing value for property 'cursor'.  Declaration dropped.
************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "'[JavaScript Error: "defURI is not defined" {file: "http://xopus.
org/demo/xopus/pipeline/pipeline.js" line: 579}]' when calling method: [nsIDOMEv
entListener::handleEvent]"  nsresult: "0x80570021 (NS_ERROR_XPC_JAVASCRIPT_ERROR
_WITH_DETAILS)"  location: "<unknown>"  data: yes]
************************************************************

Note: I don't get this exception in Netscape 7.0

Comment 7

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Works fine with NS 7 on win2k.

With latest mozilla trunk the editor does not seem to load properly; I only get
some JS warnings in the console but that's all.

Closing as worksforme.

Comment 8

[José Jeria]

Reopening, with latest build 2002102308 on both Windows 2000 and XP i get a
crash. On my XP I even did a completely clean install and new profile. 

Talkback IDs:
TB13003384Y 
TB13003552E

Comment 9

[José Jeria]

WFM now with build 2002111804, Windows XP.

Comment 10

[Martijn Wargers (dead)]

Attachment: Talback crash incident1

This thing is crashing again for me. 
Somehow I can't get the talkback incident to send it to Mozilla, so I put it
here as attachment.

Comment 11

[Martijn Wargers (dead)]

I think they have changed a little since the 2002. The original url is being
redirected.
This is the official url:
http://xopus.com/demo/index.html
Click on Simple Document Demo.

I've investigated that demo a bit. I've squeezed the immense amount of
javascript down to this testcase I will attach.

This crashes, but when you remove the media folder you get an alert box with the
text:
The file c:\\...\...wrongbrowser.html could not be found, etc...
So I guess the crash happens, at the moment you are being redirected.


[e-mail] has a debug build and gets this callstack for it:

crasht in jsinterp.c on 1933:
           OBJ_ENUMERATE(cx, obj, JSENUMERATE_NEXT, &iter_state, &rval);

Ik weet niks van de JS module maar obj == 0x0000000 en dat zal vast niet goed zijn.

Ik krijg deze callstack:

js_Interpret(JSContext * 0x03077eb0, long * 0x0012ef6c) line 1933 + 30 bytes
js_Execute(JSContext * 0x03077eb0, JSObject * 0x03011828, JSScript * 0x042eb888,
JSStackFrame * 0x00000000, unsigned int 0, long * 0x0012ef6c) line 1155 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x03077eb0, JSObject * 0x03011828,
JSPrincipals * 0x02f85ea4, const unsigned short * 0x03bb0040, unsigned int
419541, const char * 0x0328af00, unsigned int 79, long * 0x0012ef6c) line 3543 +
25 bytes
nsJSContext::EvaluateString(const nsAString & {...}, void * 0x03011828,
nsIPrincipal * 0x02f85ea0, const char * 0x0328af00, unsigned int 79, const char
* 0x00cb4430, nsAString & {...}, int * 0x0012efa8) line 916 + 85 bytes
nsScriptLoader::EvaluateScript(nsScriptLoadRequest * 0x0328ae40, const
nsAFlatString & {...}) line 658
nsScriptLoader::ProcessRequest(nsScriptLoadRequest * 0x0328ae40) line 574 + 22 bytes
nsScriptLoader::ProcessScriptElement(nsScriptLoader * const 0x02f85d08,
nsIDOMHTMLScriptElement * 0x03282d10, nsIScriptLoaderObserver * 0x03282d14) line
520 + 20 bytes
nsHTMLScriptElement::MaybeProcessScript() line 646 + 118 bytes
nsHTMLScriptElement::SetDocument(nsIDocument * 0x02f83f88, int 0, int 1) line 471
nsGenericElement::AppendChildTo(nsIContent * 0x03282cf0, int 0, int 0) line 2583
HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 4353
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x02f85b60, const nsIParserNode
& {...}) line 3210 + 15 bytes
CNavDTD::AddLeaf(const nsIParserNode * 0x0328aaa8) line 3787 + 25 bytes
CNavDTD::HandleScriptToken(const nsIParserNode * 0x0328aaa8) line 2325 + 12 bytes
CNavDTD::OpenContainer(const nsCParserNode * 0x0328aaa8, nsHTMLTag
eHTMLTag_script, int 1, nsEntryStack * 0x00000000) line 3439 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x0313b770, nsHTMLTag eHTMLTag_script,
nsCParserNode * 0x0328aaa8) line 1457 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x0313b770) line 1835 + 20 bytes
CNavDTD::HandleToken(CNavDTD * const 0x0312fab8, CToken * 0x00000000, nsIParser
* 0x02f85870) line 1019 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x0312fab8, nsIParser * 0x02f85870,
nsITokenizer * 0x031301a0, nsITokenObserver * 0x00000000, nsIContentSink *
0x02f85b60) line 511 + 20 bytes
nsParser::BuildModel(nsParser * const 0x02f85870) line 1894 + 34 bytes
nsParser::ResumeParse(int 1, int 0, int 1) line 1761 + 12 bytes
nsParser::OnDataAvailable(nsParser * const 0x02f85874, nsIRequest * 0x03021e10,
nsISupports * 0x00000000, nsIInputStream * 0x03114760, unsigned int 415524,
unsigned int 7862) line 2426 + 21 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x030160a0,
nsIRequest * 0x03021e10, nsISupports * 0x00000000, nsIInputStream * 0x03114760,
unsigned int 415524, unsigned int 7862) line 335 + 46 bytes
nsStreamListenerTee::OnDataAvailable(nsStreamListenerTee * const 0x030b9918,
nsIRequest * 0x03021e10, nsISupports * 0x00000000, nsIInputStream * 0x0304f29c,
unsigned int 415524, unsigned int 7862) line 97 + 51 bytes
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x03021e18, nsIRequest *
0x030486f8, nsISupports * 0x00000000, nsIInputStream * 0x0304f29c, unsigned int
415524, unsigned int 7862) line 3455 + 63 bytes
nsInputStreamPump::OnStateTransfer() line 433 + 65 bytes
nsInputStreamPump::OnInputStreamReady(nsInputStreamPump * const 0x030486fc,
nsIAsyncInputStream * 0x0304f29c) line 336 + 11 bytes
nsInputStreamReadyEvent::EventHandler(PLEvent * 0x030b5f3c) line 119
PL_HandleEvent(PLEvent * 0x030b5f3c) line 671 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00a06ed0) line 606 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0004017a, unsigned int 49360, unsigned int 0,
long 10514128) line 1412 + 9 bytes
USER32! 77d43a50()
USER32! 77d43b1f()
USER32! 77d43d79()
USER32! 77d43ddf()
nsAppShellService::Run(nsAppShellService * const 0x00a4e2c8) line 484
main1(int 1, char * * 0x002e2638, nsISupports * 0x009aeed8) line 1291 + 32 bytes
main(int 1, char * * 0x002e2638) line 1678 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e814c7()

Comment 12

[Martijn Wargers (dead)]

Attachment: Simpler testcase crasher

Comment 13

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Reopening per comments.

Comment 14

[Brendan Eich [:brendan]]

*** Bug 237967 has been marked as a duplicate of this bug. ***

Comment 15

[Brendan Eich [:brendan]]

Need a reduced testcase, please -- or at least one where the whole roughly
hundred-thousand-character script is not on one line.

/be

Comment 16

[Martijn Wargers (dead)]

Attachment: very much simpeler testcase

Managed to reduce most of the code.
I don't know if this is the initial cause of the crash, but at least this one
is crashing too.

Comment 17

[Brendan Eich [:brendan]]

Regressed a long time ago:

revision 3.6.4.11
date: 1999/01/28 00:03:51;  author: rogerl%netscape.com;  state: Exp;  lines: +31 -8
Bug #331783 - separate initialization from increment for 'for in' loop
with index expression in order to prevent side-effects from occuring
when the for loop stops (as in 'for (p[i++] in obj)...')

Bug is obvious, patch next.

/be

Comment 18

[Brendan Eich [:brendan]]

Attachment: proposed fix

Comment 19

[Brendan Eich [:brendan]]

Comment on attachment 144534 [details] [diff] [review]
proposed fix

Nice safe (if long overdue!) crash bug fix for 1.7.

/be

Comment 20

[chris hofmann]

Comment on attachment 144534 [details] [diff] [review]
proposed fix

a=chofmann for 1.7

Comment 21

[Brendan Eich [:brendan]]

Fixed.

Could have used this in 1.4.2 (the bug is ancient), but it sounds like it's too
late.  Cc'ing leaf just in case.

/be

Comment 22

[Adam Hauner]

*** Bug 240582 has been marked as a duplicate of this bug. ***

Comment 23

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/Regress/regress-174709.js

Martijn, with your permission this will be included in the javascript test
library.

Comment 24

[Martijn Wargers (dead)]

(In reply to comment #23)
> Martijn, with your permission this will be included in the javascript test
> library.
Sure, no problem.

Comment 25

[Lon Boonen]

(In reply to comment #24)
> (In reply to comment #23)
> > Martijn, with your permission this will be included in the javascript test
> > library.
> Sure, no problem.

Dear Mozilla developers,

I would like to point out that you have taken code owned by Q42 
(http://www.q42.nl), removed the copyright notice, changed the code and added 
the MPL 1.1 license to it.

We, Q42, have never allowed anyone to remove our copyrights nor alter the code 
or parts of it, nor re-license the code nor parts of it.

We, of course, are very sympathetic towards the Mozilla project and would like 
to help them any way we can. But we would like the Mozilla foundation and its 
developers to respect our copyrights as well.

Friendly, yet worried, greetings, Lon Boonen, Q42

Comment 26

[Martijn Wargers (dead)]

Oops! Sorry Lon. I've made the reduced testcase indeed from xopus, so I'm not
the owner of that code, so I can't give permission.

Comment 27

[Bob Clary [:bc] (inactive)]

Comment on attachment 174985 [details]
js1_5/Regress/regress-174709.js

Lon, it was never our intension to take your code which is why I have gone
through this process of vetting the testcases. I will remove the code from the
testcase immediately.

Comment 28

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/Regress/regress-174709.js

testcase with code removed until replacement code can be created.

Comment 29

[Lon Boonen]

We have no objection to Mozilla using this code for fixing bugs and testing.
We just thought it was kind of inappropriate to remove copyrights and to attach 
the MPL to it.

I hereby give Mozilla the right to use the piece of code extracted by Martijn 
for whatever purpose it (Mozilla) seems fit. You can re-license it also if 
that's necessary.

The important thing is that this bug is fixed...
We have another one that we would like fixed, but I guess I have to mention 
that somewhere else.

Greetings and thanks, Lon

Comment 30

[Bob Clary [:bc] (inactive)]

js1_5/Regress/regress-174709.js checked in.

Comment 31

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060818