Closed Bug 295430 Opened 19 years ago Closed 19 years ago

[FIXr]XPCNativeWrapper.prototype.toString(); crashes

Categories

(Core :: DOM: Core & HTML, defect, P1)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla1.8beta3

People

(Reporter: sync2d, Assigned: bzbarsky)

References

(
URL
)

Details

(Keywords: crash)

Attachments

(2 files)

Simple fix
1.39 KB, patch
bzbarsky
: review-
bzbarsky
: superreview-
Details | Diff | Splinter Review
Updated to comments
1.38 KB, patch
jst
: review+
jst
: superreview+
shaver
: approval1.8b3+
Details | Diff | Splinter Review 
User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050524 Firefox/1.0+ (2005052406)



Reproducible: Always

Steps to Reproduce:
1. navigate the browser to
javascript: XPCNativeWrapper.prototype.toString();

Actual Results:  
the browser crashes.


Expected Results:  
do not crash and display the string value of XPCNativeWrapper.prototype.


FIREFOX caused an invalid page fault in
module FIREFOX.EXE at 015f:00419f55.
XPC_NW_toString 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp,
line 928]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1182]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3473]
js_Execute 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1413]
JS_EvaluateUCScriptForPrincipals 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3793]
nsJSContext::EvaluateString 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1037]
nsJSThunk::EvaluateScript 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp,
line 255]
nsJSChannel::InternalOpen 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp,
line 508]
nsJSChannel::AsyncOpen 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp,
line 480]
nsURILoader::OpenURI 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 878]
nsDocShell::DoChannelLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 6580]
nsDocShell::DoURILoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 6438]
nsDocShell::InternalLoad 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 6205]
nsDocShell::LoadURI 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 780]
nsDocShell::LoadURI 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 2800]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2094]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1330]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1182]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3473]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1202]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3473]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1202]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3473]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1202]
fun_apply 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsfun.c, line
1565]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1182]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3473]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1202]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1279]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3858]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1386]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsXBLPrototypeHandler::ExecuteHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLPrototypeHandler.cpp,
line 494]
nsXBLKeyEventHandler::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xbl/src/nsXBLEventHandler.cpp,
line 143]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1568]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1669]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2194]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2173]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 2079]
nsHTMLInputElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 1380]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6324]
PresShell::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 6167]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2457]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2224]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1180]
nsWindow::DispatchKeyEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3491]
nsWindow::OnKeyDown 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3630]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 4496]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1472]
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0x8816 (0x77d48816)
USER32.dll + 0x89cd (0x77d489cd)
USER32.dll + 0x8a10 (0x77d48a10)
nsAppShell::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 208]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1763]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1787]
kernel32.dll + 0x16d4f (0x7c816d4f)
Severity: normal → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash
Attached patch Simple fix — — Splinter Review 

        Attachment #184472 -
        Flags: superreview?(jst)

        Attachment #184472 -
        Flags: review?(jst)

    
  
OS: Windows 98 → All
Hardware: PC → All

    
    

    
  
Comment on attachment 184472 [details] [diff] [review]
Simple fix

+    // toString() called on XPCNativeWrapper.prototype
+    NS_NAMED_LITERAL_STRING(protoString, "XPCNativeWrapper.prototype");

If you alert Object.prototype you get "[object Object]", shouldn't we make this
match in behaviour?

    
    

    
  
Sure.  I didn't really know what string to use, since Node.prototype and
Element.prototype actually returned different things...

I guess we can make this one "[object XPCNativeWrapper]"

    
    

    
  
Object.prototype.toString() ==> "[object Object]"
Function.prototype.toString() ==> "\nfunction () {\n}\n"
Array.prototype.toString() ==> ""
String.prototype.toString() ==> ""
Boolean.prototype.toString() ==> "false"
Number.prototype.toString() ==> "0"
Date.prototype.toString() ==> "Invalid Date"
RegExp.prototype.toString() ==> "/(?:)/"
Error.prototype.toString() ==> "Error"
Script.prototype.toString() ==> ""
Window.prototype.toString() ==> "[xpconnect wrapped native prototype]"
Document.prototype.toString() ==> "[object DOM Constructor.prototype]"
Location.prototype.toString() ==> error NS_ERROR_XPC_BAD_OP_ON_WN_PROTO
DOMException.prototype.toString() ==> error NS_ERROR_XPC_BAD_OP_ON_WN_PROTO

List for reference purpose.

    
    

    
  


  

        Attachment #184691 -
        Flags: superreview?(jst)

        Attachment #184691 -
        Flags: review?(jst)

    
  

        Attachment #184472 -
        Flags: superreview?(jst)

        Attachment #184472 -
        Flags: superreview-

        Attachment #184472 -
        Flags: review?(jst)

        Attachment #184472 -
        Flags: review-

    
  
Assignee: general → bzbarsky
Priority: -- → P1
Summary: XPCNativeWrapper.prototype.toString(); crashes → [FIX]XPCNativeWrapper.prototype.toString(); crashes
Target Milestone: --- → mozilla1.8beta3

    
    

    
  
Comment on attachment 184691 [details] [diff] [review]
Updated to comments

r+sr=jst

        Attachment #184691 -
        Flags: superreview?(jst)

        Attachment #184691 -
        Flags: superreview+

        Attachment #184691 -
        Flags: review?(jst)

        Attachment #184691 -
        Flags: review+

    
    

    
  
Comment on attachment 184691 [details] [diff] [review]
Updated to comments

Requesting 1.8b3 approval for simple crash fix.

        Attachment #184691 -
        Flags: approval1.8b3?

    
  
Summary: [FIX]XPCNativeWrapper.prototype.toString(); crashes → [FIXr]XPCNativeWrapper.prototype.toString(); crashes

    
    

    
  
Comment on attachment 184691 [details] [diff] [review]
Updated to comments

a=shaver

        Attachment #184691 -
        Flags: approval1.8b3? → approval1.8b3+

    
    

    
  
Fixed for 1.8b3.
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED

    
    

    
  
Verified FIXED with build 2005-06-02-06 on Windows XP Seamonkey trunk using
javascript: XPCNativeWrapper.prototype.toString(); 

I see [object XPCNativeWrapper] in plaintext in the browser, instead of a crash.
Status: RESOLVED → VERIFIED
Component: DOM → DOM: Core & HTML

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: