225995 - crash in nsOSHelperAppService::GetValueString triggered by xmldoc.load()

Status: RESOLVED FIXED

(Core Graveyard :: File Handling, defect, P1)

Description

[Axel Hecht]

here's the stack

nsCharTraits<unsigned short>::length(const unsigned short * 0x00000000) line 200
+ 5 bytes
nsCString::AppendWithConversion(const unsigned short * 0x00000000, int
0xffffffff) line 702 + 9 bytes
NS_LossyConvertUTF16toASCII::NS_LossyConvertUTF16toASCII(const unsigned short *
0x00000000) line 462
nsOSHelperAppService::GetValueString(HKEY__ * 0xc19e8eb0, unsigned short *
0x00000000, nsAString & {...}) line 206 + 15 bytes
nsOSHelperAppService::GetByExtension(const char * 0x0069cb58, const char *
0x00000000) line 406 + 18 bytes
nsOSHelperAppService::GetMIMEInfoFromOS(const char * 0x00000000, const char *
0x0069cb58, int * 0x0069cabc) line 494 + 20 bytes
nsExternalHelperAppService::GetFromTypeAndExtension(nsExternalHelperAppService *
const 0x009a21cc, const char * 0x00000000, const char * 0x0069cb58, nsIMIMEInfo
* * 0x0069cb18) line 2155 + 31 bytes
nsExternalHelperAppService::GetTypeFromExtension(nsExternalHelperAppService *
const 0x009a21cc, const char * 0x0069cb58, char * * 0x0392a874) line 2251 + 42 bytes
nsExternalHelperAppService::GetTypeFromFile(nsExternalHelperAppService * const
0x009a21cc, nsIFile * 0x0392a78c, char * * 0x0392a874) line 2389 + 29 bytes
nsFileChannel::GetContentType(nsFileChannel * const 0x0392a2bc, nsACString &
{...}) line 301
nsDocument::StartDocumentLoad(nsDocument * const 0x039294a0, const char *
0x01e0e940 kLoadAsData, nsIChannel * 0x0392a2bc, nsILoadGroup * 0x00980e6c,
nsISupports * 0x00000000, nsIStreamListener * * 0x0069d1c0, int 0x00000000,
nsIContentSink * 0x00000000) line 751 + 16 bytes
nsXMLDocument::StartDocumentLoad(nsXMLDocument * const 0x039294a0, const char *
0x01e0e940 kLoadAsData, nsIChannel * 0x0392a2bc, nsILoadGroup * 0x00980e6c,
nsISupports * 0x00000000, nsIStreamListener * * 0x0069d1c0, int 0x00000000,
nsIContentSink * 0x00000000) line 618 + 37 bytes
nsXMLDocument::Load(nsXMLDocument * const 0x03929508, const nsAString & {...},
int * 0x0069d370) line 533 + 72 bytes

PRBool found = GetValueString(hKey, NULL, description);
seems to be the offending call, NULL being the bad child. That happens in 
nsOSHelperAppService.cpp:406 and other places. Not sure if the call is bad or
if GetValueString needs diapers.

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: suggested patch

this should work, but I can't test it

Comment 2

[Axel Hecht]

Comment on attachment 135738 [details] [diff] [review]
suggested patch

this patch fixes the crasher for me, seems like it's the right thing to do.

Comment 3

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 135738 [details] [diff] [review]
suggested patch

bz, would be great if you could sr this too before the freeze

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 135738 [details] [diff] [review]
suggested patch

Seems reasonable.

Comment 5

[Christian :Biesinger (don't email me, ping me on IRC)]

thanks,
Checking in nsOSHelperAppService.cpp;
/cvsroot/mozilla/uriloader/exthandler/win/nsOSHelperAppService.cpp,v  <-- 
nsOSHelperAppService.cpp
new revision: 1.49; previous revision: 1.48
done

Comment 6

[Hermann Schwab]

*** Bug 225843 has been marked as a duplicate of this bug. ***

Comment 7

[Olivier Cahagne]

*** Bug 225853 has been marked as a duplicate of this bug. ***

Comment 8

[Mats Palmgren (inactive)]

*** Bug 226075 has been marked as a duplicate of this bug. ***