220516 - [FIX]crash in sort by speed [@ XULSortServiceImpl::Sort]

Status: RESOLVED FIXED

(Core :: XUL, defect, P1)

Description

[Sobrinho]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20030927
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20030927

when I use sort by speed, with no download in progress, mozilla crash

Reproducible: Always

Steps to Reproduce:
1.no download in progress
2.Tools > Donload manager
3.sort by speed
4.mozilla crash

Actual Results:  
crash

Expected Results:  
don't crash

build id: 2003092704

MOZILLA causou uma falha de página inválida no
módulo GKLAYOUT.DLL em 015f:615873ea.
Registros:
EAX=00000000 CS=015f EIP=615873ea EFLGS=00010246
EBX=ffffffff SS=0167 ESP=0065e43c EBP=0065e458
ECX=0226a040 DS=0167 ESI=00000000 FS=24ff
EDX=0185bc3c ES=0167 EDI=0185a740 GS=0000
Bytes em CS:EIP:
8b 06 ff 90 9c 00 00 00 85 c0 74 6e 8b 45 fc 83 
Esvaziamento da pilha:
00000000 00000010 61634914 00000000 80000000 02219420 006eb45c 0065e724 61588580
0226a040 0065e6b8 00000000 0065e78c 0065e904 00747619 61da4758

Comment 1

[Charles Fenwick]

Seems to be a duplicate of bug 220464.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Actually, it's not.  This is a crash in the XUL sort service introduced by jst's
checkin.  Basic problem is that a PRUint32 is always >= 0, so some for loops run
off ends of arrays....

Comment 3

[Boris Zbarsky [:bzbarsky]]

Taking.  If anyone cares, btw, the crash stack is:

XULSortServiceImpl::Sort(nsIDOMNode*, nsAString const&, nsAString
const&)+0x000011B0
[/home/bzbarsky/mozilla/debug/obj-debug/dist/bin/components/libgklayout.so
+0x0094386C]
XPTC_InvokeByIndex+0x00000029
[/home/bzbarsky/mozilla/debug/obj-debug/dist/bin/libxpcom.so +0x0013C399]
XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode)+0x00001148
[/home/bzbarsky/mozilla/debug/obj-debug/dist/bin/components/libxpconnect.so
+0x0008C862]
XPC_WN_CallMethod(JSContext*, JSObject*, unsigned, long*, long*)+0x000001A5
[/home/bzbarsky/mozilla/debug/obj-debug/dist/bin/components/libxpconnect.so
+0x00096B11]
js_Invoke+0x00000C9E
[/home/bzbarsky/mozilla/debug/obj-debug/dist/bin/libmozjs.so +0x00049192]
js_Interpret+0x0000CA8F
[/home/bzbarsky/mozilla/debug/obj-debug/dist/bin/libmozjs.so +0x000570A3]

Comment 4

[Boris Zbarsky [:bzbarsky]]

*** Bug 220521 has been marked as a duplicate of this bug. ***

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Patch

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed.