46979 - Crash when pressing save button on wallet interview html form

Status: VERIFIED FIXED

(SeaMonkey :: General, defect, P3)

Description

[Stephen P. Morse]

1. Create fresh profile

2. Start browser

3. Open wallet interview form either by going to the URL noted above or by using 
the task menu (tasks->privacy->form-manager->interview).

Note: it will take a long time for this page to appear and just before it does 
you will get numerous assertion failures.  These are covered in bug 42451 (long 
delay) and bug 46943 (assertion failures).

4. Press any of the save buttons on the page (there are about a half dozen of 
them)

5. Following crash will occur

nsBrowserInstance::ReinitializeContentVariables() line 402 + 36 bytes
nsBrowserInstance::GetContentAreaDocShell() line 413
nsBrowserInstance::CanHandleContent(nsBrowserInstance * const 0x04af45a8, const 
char * 0x04cb67f0, int 0, const char * 0x1009fc78 gCommonEmptyBuffer, char * * 
0x0012d81c, int * 0x0012d648) line 1680 + 13 bytes
nsURILoader::ShouldHandleContent(nsIURIContentListener * 0x04af45a8, const char 
* 0x04cb67f0, int 0, const char * 0x1009fc78 gCommonEmptyBuffer, char * * 
0x0012d81c) line 748
nsURILoader::DispatchContent(nsURILoader * const 0x00f7c930, const char * 
0x04cb67f0, int 0, const char * 0x1009fc78 gCommonEmptyBuffer, nsIChannel * 
0x04cb6b10, nsISupports * 0x00000000, nsIURIContentListener * 0x04af5210, 
nsISupports * 0x04af3940, char * * 0x0012d81c, nsIURIContentListener * * 
0x0012d824, int * 0x0012d814) line 814 + 28 bytes
nsDocumentOpenInfo::DispatchContent(nsIChannel * 0x04cb6b10, nsISupports * 
0x00000000) line 302 + 165 bytes
nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x04cb68c0, 
nsIChannel * 0x04cb6b10, nsISupports * 0x00000000) line 233 + 16 bytes
nsCachedChromeChannel::HandleStartLoadEvent(PLEvent * 0x04cb6870) line 510
PL_HandleEvent(PLEvent * 0x04cb6870) line 587 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x04af5ad0) line 528 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x01bc086e, unsigned int 49416, unsigned int 0, 
long 78600912) line 1043 + 9 bytes
USER32! 77e71268()
04af5ad0

Comment 1

[Stephen P. Morse]

Crash is occuring on the following line in ReinitializeContentVariables of 
nsBrowserInstance.cpp.  danm and hyatt were the last two people to modify these 
lines of code.

void
nsBrowserInstance::ReinitializeContentVariables()
{
    nsCOMPtr<nsIDOMWindow> content;
    mDOMWindow->Get_content(getter_AddRefs(content));
    SetContentWindow(content);
}

Without understanding what this is used for, I naively fixed this in my own tree 
by adding the following test around these lines of code.  It stopped the 
crash.  Let me know if this is the correct thing to do, in which case I'll check 
in the fix.

void
nsBrowserInstance::ReinitializeContentVariables()
{
  if (mDOMWindow) {
    nsCOMPtr<nsIDOMWindow> content;
    mDOMWindow->Get_content(getter_AddRefs(content));
    SetContentWindow(content);
  }
}

Comment 2

[Stephen P. Morse]

Oops, I forgot to anotate the crash line in the code above.  It is the line that 
reads:

   mDOMWindow->Get_content(getter_AddRefs(content));

and mDOMWindow is null at this time.

Comment 3

[Blake Ross]

spam: Adding crash keyword...

Comment 4

[Peter Trudelle]

->danm

Comment 5

[Dan M]

The null mDOMWindow happened because the browser instance created by 
interview.html JS was never initialized. Browser instances are twitchy, and want 
to be put to sleep. Don't wanna talk much about the concept of creating a browser 
instance within a web page ... rrr ... rrr ... but anyway, I've added 
initialization. Crash gone.

Comment 6

[Doron Rosenberg (IBM)]

verified 2000090908, no crash win98