Closed Bug 79018 Opened 24 years ago Closed 24 years ago

Crash in Trunk [@ nsWalletlibService::OnStateChange]

Categories

(Core :: DOM: Navigation, defect)

defect
Not set
major

Tracking

()

VERIFIED FIXED
mozilla0.9.1

People

(Reporter: pavlov, Assigned: jud)

References

()

Details

(Keywords: crash, topcrash)

Crash Data

Load the URL above in a recent build of Mozilla.  It will bring up the Save As 
dialog and then proceed to crash.

I'm assigning this to valeski since I believe his recent changes to this file 
and related ones are related to this crash.

Returning an error from nsDocLoaderImpl::GetDOMWindow() when mContainer is NULL 
will keep the crash from happening, however, I'm not sure that mContainer is 
supposed to be null, so i'm filing you this bug. :)

stack trace:
NTDLL! 77f9eea9()
nsDebug::Assertion(const char * 0x02ca3c7c `string', const char * 0x02ca3cc0 
`string', const char * 0x02ca3cd0 `string', int 649) line 290 + 13 bytes
nsDebug::PreCondition(const char * 0x02ca3c7c `string', const char * 0x02ca3cc0 
`string', const char * 0x02ca3cd0 `string', int 649) line 434 + 21 bytes
nsCOMPtr<nsIDOMWindow>::operator->() line 649 + 34 bytes
nsWalletlibService::OnStateChange(nsWalletlibService * const 0x02883afc, 
nsIWebProgress * 0x03ae943c, nsIRequest * 0x04407a38, int 131088, unsigned int 
0) line 260 + 35 bytes
nsDocLoaderImpl::FireOnStateChange(nsIWebProgress * 0x03ae943c, nsIRequest * 
0x04407a38, int 131088, unsigned int 0) line 1090
nsDocLoaderImpl::FireOnStateChange(nsIWebProgress * 0x03ae943c, nsIRequest * 
0x04407a38, int 131088, unsigned int 0) line 1098
nsDocLoaderImpl::doStopDocumentLoad(nsIRequest * 0x04407a38, unsigned int 0) 
line 731
nsDocLoaderImpl::DocLoaderIsEmpty() line 629
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x03ae942c, nsIRequest * 
0x04407a38, nsISupports * 0x00000000, unsigned int 0) line 560
nsLoadGroup::RemoveRequest(nsLoadGroup * const 0x03ae9630, nsIRequest * 
0x04407a38, nsISupports * 0x00000000, unsigned int 0) line 512 + 44 bytes
nsHTTPChannel::ResponseCompleted(nsIStreamListener * 0x03ae4f38, unsigned int 
0) line 2387
nsHTTPServerListener::OnStopRequest(nsHTTPServerListener * const 0x04412e40, 
nsIRequest * 0x03a83198, nsISupports * 0x04407a38, unsigned int 0) line 712
nsOnStopRequestEvent::HandleEvent() line 159
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x0457a6b4) line 64
PL_HandleEvent(PLEvent * 0x0457a6b4) line 588 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00e6ed48) line 518 + 9 bytes
*** Bug 78922 has been marked as a duplicate of this bug. ***
Severity: normal → major
Keywords: crash
OS: Windows 2000 → All
Hardware: PC → All
*** Bug 78905 has been marked as a duplicate of this bug. ***
Loading http://dogspit/ibench/performance_tests/perf_acrobat.asp will also 
cause the Save As dialog to pop up causing the crash.
I've got a same crash when I downloaded something via ftp.
Status: NEW → ASSIGNED
Target Milestone: --- → mozilla0.9.1
*** Bug 79095 has been marked as a duplicate of this bug. ***
*** Bug 79061 has been marked as a duplicate of this bug. ***
status: there are a couple of solutions here, all easy, I'm just bantering
around w/ rpotts as to what the "best" one is.

options:
1. nsDocLoaderImpl::GetDOMWindow(). the method name would imply that if it can't
produce a DOM window (perfectly valid in the docloader), it should return
NS_ERROR_FAILURE. if we go this route, then the crash goes away because my
code's already handling it.
2. we can just check for a null out param (I have religious beliefs that prevent
me from liking this solution :-).
*** Bug 79160 has been marked as a duplicate of this bug. ***
*** Bug 79162 has been marked as a duplicate of this bug. ***
haven't talked to rick, but looking at all the callers of GetDOMWindow() we'll
be fine returning failure from the docloader in this case, and this will let
wallet graciously fail.

Index: nsDocLoader.cpp
===================================================================
RCS file: /cvsroot/mozilla/uriloader/base/nsDocLoader.cpp,v
retrieving revision 3.236
diff -u -1 -4 -r3.236 nsDocLoader.cpp
--- nsDocLoader.cpp     2001/05/04 20:11:49     3.236
+++ nsDocLoader.cpp     2001/05/07 17:35:42
@@ -779,28 +779,30 @@
 nsDocLoaderImpl::GetDOMWindow(nsIDOMWindow **aResult)
 {
   nsresult rv = NS_OK;

   *aResult = nsnull;
   //
   // The DOM Window is available from the associated container (ie DocShell)
   // if one is available...
   //
   if (mContainer) {
     nsCOMPtr<nsIDOMWindow> window(do_GetInterface(mContainer, &rv));

     *aResult = window;
     NS_IF_ADDREF(*aResult);
+  } else {
+      rv = NS_ERROR_FAILURE;
   }

   return rv;
 }
*** Bug 79126 has been marked as a duplicate of this bug. ***
I'm not sure I agree that a null return value warrants an error code, but it
seems safe in this circumstance. Most callers seem to be checking the return
value, so it's not going to change control flow in existing calling scenarios
considerably. sr=vidur.
fix is in.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
*** Bug 79081 has been marked as a duplicate of this bug. ***
*** Bug 79082 has been marked as a duplicate of this bug. ***
*** Bug 78936 has been marked as a duplicate of this bug. ***
*** Bug 79163 has been marked as a duplicate of this bug. ***
*** Bug 79259 has been marked as a duplicate of this bug. ***
*** Bug 79192 has been marked as a duplicate of this bug. ***
*** Bug 79235 has been marked as a duplicate of this bug. ***
*** Bug 79257 has been marked as a duplicate of this bug. ***
*** Bug 79390 has been marked as a duplicate of this bug. ***
*** Bug 79426 has been marked as a duplicate of this bug. ***
*** Bug 79300 has been marked as a duplicate of this bug. ***
Adding topcrash keyword and [@ nsWalletlibService::OnStateChange] for tracking
purposes.  From all the dups, it's clear that this crash *was* a topcrasher for
a few days.
Keywords: topcrash
Summary: Crash in nsWalletlibService::OnStateChange() → Crash in Trunk [@ nsWalletlibService::OnStateChange]
Works alright now: win98, 2001-05-08-17-trunk.
18 dups... with a descriptive summary like "Crash in Trunk", who'd have thought?
WFM, WindowsME, 2001071703 build. Not verifying as this is a All/All bug and we
do not have WFM reports from Linux and Mac.
Verified, stack signature not showing up in trunk, M097, or N621
Status: RESOLVED → VERIFIED
Crash Signature: [@ nsWalletlibService::OnStateChange]
You need to log in before you can comment on or make changes to this bug.