94926 - a few urls cause assert/crash (hEntry) in nsDocShell::SetTitle()

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect, P3)

Description

[Chak Nanga]

Here are the comments from an old bug on this issue:

in mozilla.exe or mfcembed. 0.9.3+ 20010807 full build. looks like something
related to getting the title for session history.
1. Load one of these urls:
http://www.mundolatino.com/honduras/honwin01.htm
2. Press Enter.
Result: This assert: "NS_ENSURE_TRUE(hEntry) failed, file 
/mozilla/docshell/base/nsDocShell.cpp line 3121"

call stack:

nsDebug::Assertion(const char * 0x026247d8, const char * 0x026247d0, const char
* 0x0262479c, int 3122) line 290 + 13 bytes
nsDebug::WarnIfFalse(const char * 0x026247d8, const char * 0x026247d0, const
char * 0x0262479c, int 3122) line 396 + 21 bytes
nsDocShell::SetTitle(nsDocShell * const 0x04f400a4, const unsigned short *
0x04f7b530) line 3122 + 38 bytes
nsDocument::SetTitle(nsDocument * const 0x04ffc9f8, const nsAString & {...})
line 2307 + 54 bytes
nsHTMLDocument::SetTitle(nsHTMLDocument * const 0x04ffc9f8, const nsAString &
{...}) line 900
XPTC_InvokeByIndex(nsISupports * 0x04ffcb30, unsigned int 46, unsigned int 1,
nsXPTCVariant * 0x0012de34) line 139
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
CALL_SETTER) line 1882 + 42 bytes
XPCWrappedNative::SetAttribute(XPCCallContext & {...}) line 1784 + 14 bytes
XPC_WN_GetterSetter(JSContext * 0x04f47600, JSObject * 0x029b1288, unsigned int
1, long * 0x04ad1360, long * 0x0012e07c) line 1276 + 9 bytes
js_Invoke(JSContext * 0x04f47600, unsigned int 1, unsigned int 2) line 807 + 23
bytes
js_InternalInvoke(JSContext * 0x04f47600, JSObject * 0x029b1288, long 43717272,
unsigned int 0, unsigned int 1, long * 0x0012ee58, long * 0x0012ee58) line 896 +
20 bytes
js_SetProperty(JSContext * 0x04f47600, JSObject * 0x029b1288, long 19584128,
long * 0x0012ee58) line 2562 + 47 bytes
js_Interpret(JSContext * 0x04f47600, long * 0x0012f084) line 2544 + 1939 bytes
js_Execute(JSContext * 0x04f47600, JSObject * 0x04a3dca8, JSScript * 0x04f78d40,
JSStackFrame * 0x00000000, unsigned int 0, long * 0x0012f084) line 986 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x04f47600, JSObject * 0x04a3dca8,
JSPrincipals * 0x04ffe920, const unsigned short * 0x0012f1e4, unsigned int 28,
const char * 0x04f7b480, unsigned int 2, long * 0x0012f084) line 3302 + 25 bytes
nsJSContext::EvaluateString(nsJSContext * const 0x04f477b0, const nsAString &
{...}, void * 0x04a3dca8, nsIPrincipal * 0x04ffe91c, const char * 0x04f7b480,
unsigned int 2, const char * 0x0138869c, nsAString & {...}, int * 0x0012f0f0)
line 611 + 85 bytes
nsScriptLoader::EvaluateScript(nsScriptLoadRequest * 0x04f7b580, const
nsAFlatString & {...}) line 566
nsScriptLoader::ProcessRequest(nsScriptLoadRequest * 0x04f7b580) line 478 + 22 bytes
nsScriptLoader::ProcessScriptElement(nsScriptLoader * const 0x04ffea00,
nsIDOMHTMLScriptElement * 0x04f7f7d8, nsIScriptLoaderObserver * 0x04f7f7dc) line
421 + 15 bytes
nsHTMLScriptElement::SetDocument(nsHTMLScriptElement * const 0x04f7f7b0,
nsIDocument * 0x04ffc9f0, int 0, int 1) line 140
nsGenericHTMLContainerElement::AppendChildTo(nsGenericHTMLContainerElement *
const 0x04f6f190, nsIContent * 0x04f7f7b0, int 0, int 0) line 3780
HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 5010
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x04ffeac0, const nsIParserNode
& {...}) line 3433 + 12 bytes
CNavDTD::AddLeaf(const nsIParserNode * 0x04a48098) line 3749 + 22 bytes
CNavDTD::HandleScriptToken(const nsIParserNode * 0x04a48098) line 2214 + 12 bytes
CNavDTD::OpenContainer(const nsCParserNode * 0x04a48098, nsHTMLTag
eHTMLTag_script, int 1, nsEntryStack * 0x00000000) line 3405 + 12 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x04a537b8, nsHTMLTag eHTMLTag_script,
nsCParserNode * 0x04a48098) line 1291 + 20 bytes
CNavDTD::HandleStartToken(CToken * 0x04a537b8) line 1701 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x04f6d760, CToken * 0x00000000, nsIParser
* 0x04ffd680) line 870 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x04f6d760, nsIParser * 0x04ffd680,
nsITokenizer * 0x04f6a770, nsITokenObserver * 0x00000000, nsIContentSink *
0x04ffeac0) line 506 + 20 bytes
nsParser::BuildModel() line 2219 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 2085 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x04ffd688, nsIRequest * 0x04f9be00,
nsISupports * 0x00000000, nsIInputStream * 0x04f43240, unsigned int 0, unsigned
int 16384) line 2690 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x04f9b9a0,
nsIRequest * 0x04f9be00, nsISupports * 0x00000000, nsIInputStream * 0x04f43240,
unsigned int 0, unsigned int 16384) line 241 + 46 bytes
nsStreamListenerTee::OnDataAvailable(nsStreamListenerTee * const 0x04f0db20,
nsIRequest * 0x04f9be00, nsISupports * 0x00000000, nsIInputStream * 0x0481cde0,
unsigned int 0, unsigned int 16384) line 56 + 51 bytes
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x04f9be04, nsIRequest *
0x04f9b280, nsISupports * 0x00000000, nsIInputStream * 0x0481cde0, unsigned int
0, unsigned int 16384) line 2179 + 57 bytes
nsOnDataAvailableEvent::HandleEvent() line 178 + 70 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x04fd5124) line 64
PL_HandleEvent(PLEvent * 0x04fd5124) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x011bb900) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001b0688, unsigned int 49459, unsigned int 0,
long 18594048) line 1071 + 9 bytes
USER32! 77e71820()
011bb900()

Here's the code segment in nsDocShell.cpp where it stops:
if (mSessionHistory) {
    PRInt32 index = -1;
    mSessionHistory->GetIndex(&index);
    nsCOMPtr<nsIHistoryEntry> hEntry;
    mSessionHistory->GetEntryAtIndex(index, PR_FALSE,
                                     getter_AddRefs(hEntry));
    NS_ENSURE_TRUE(hEntry, NS_ERROR_FAILURE);
    nsCOMPtr<nsISHEntry> shEntry(do_QueryInterface(hEntry));
    if (shEntry)
        shEntry->SetTitle(mTitle.get());
}

Comment 1

[David Epstein]

per WRMB discussion, making dependent of 90787 topembed.

Comment 2

[David Epstein]

this url is working in the 8/17 nightly build.

Comment 3

[Radha on family leave (not reading bugmail)]

updating url

Comment 4

[Radha on family leave (not reading bugmail)]

Attachment: Patch to docshell

Comment 5

[Radha on family leave (not reading bugmail)]

It is tough to reproduce this bug, since the site serves different popups each
time you visit and the assertion seems to happen only when the casino applet is
loaded. I have not seen a crash at this site. As far as fixing this, I don't see
a need to assert when there is no valid SHEntry to set a title. So, I have
replaced the NS_ASSERT with a simple if hEntry() statement.  It looks like this
isn't going to cause much functionality loss, since somewhere down the line, the
return value from SetTitle(0 is ignored. 

Comment 6

[rpotts (gone)]

So this is really just a rouge ASSERT...  It doesn't affect the optimized build
at  all...

I've randomly hit this assert too :-)  So, I hvae no great love for it!!  I
guess the only issue is whether it is ok for GetEntryAtIndex(...) to fail -
assuming that the 'index' argument is valid.

As long as this assert is not indicating an inconsistancy within SH, I say get
rid  of it :-)

r=rpotts

-- rick

Comment 7

[Adam Lock]

Patch looks good to me too. r=adamlock

Comment 8

[Asa Dotzler [:asa]]

a=asa on behalf of drivers.

Comment 9

[Radha on family leave (not reading bugmail)]

Fix checked in

Comment 10

[David Epstein]

No more hEntry assert. Mozilla 1.2a Gecko 20020910