502617 - Crash when logging in to Facebook [@ JS_GetClass - nsDOMConstructor::HasInstance]

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

I'll test on a debug build too.

   1.
      0   libmozjs.dylib                      0x00146496 JS_GetClass + 6
   2.
      1   libgklayout.dylib                   0x18154c0f nsDOMConstructor::HasInstance(nsIXPConnectWrappedNative*, JSContext*, JSObject*, long, int*, int*) + 95
   3.
      2   libxpconnect.dylib                  0x110327e1 XPC_WN_Helper_HasInstance(JSContext*, JSObject*, long, int*) + 129
   4.
      3   libmozjs.dylib                      0x0018c211 js_Interpret + 8113
   5.
      4   libmozjs.dylib                      0x0019a9ab js_Invoke + 1707
   6.
      5   libxpconnect.dylib                  0x11027ab4 nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) + 4116
   7.
      6   libxpconnect.dylib                  0x11021ca3 nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) + 67
   8.
      7   libxpcom_core.dylib                 0x002e3264 PrepareAndDispatch(nsXPTCStubBase*, unsigned int, unsigned int*) + 132
   9.
      8   libxpcom_core.dylib                 0x002e33e6 nsXPTCStubBase::Stub3() + 54
  10.
      9   libgklayout.dylib                   0x17ff150d nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsPIDOMEventTarget*, unsigned int) + 61
  11.
      10  libgklayout.dylib                   0x17ff1b1d nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsPIDOMEventTarget*, unsigned int, nsEventStatus*) + 1197
  12.
      11  libgklayout.dylib                   0x1800a534 nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int, int) + 100
  13.
      12  libgklayout.dylib                   0x1800af21 nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, int) + 305
  14.
      13  libgklayout.dylib                   0x1800b62e nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) + 1182
  15.
      14  libgklayout.dylib                   0x1800b98f nsEventDispatcher::DispatchDOMEvent(nsISupports*, nsEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) + 255
  16.
      15  libgklayout.dylib                   0x17f8141a nsDocument::DispatchEvent(nsIDOMEvent*, int*) + 90
  17.
      16  libgklayout.dylib                   0x17f7206a nsContentUtils::DispatchTrustedEvent(nsIDocument*, nsISupports*, nsAString_internal const&, int, int, int*) + 122
  18.
      17  libgklayout.dylib                   0x17f915d2 nsDocument::DispatchContentLoadedEvents() + 98
  19.
      18  libgklayout.dylib                   0x17f942db nsRunnableMethod<nsDocument, void>::Run() + 43
  20.
      19  libxpcom_core.dylib                 0x002d38d7 nsThread::ProcessNextEvent(int, int*) + 215
  21.
      20  libxpcom_core.dylib                 0x00290797 NS_ProcessPendingEvents_P(nsIThread*, unsigned int) + 103
  22.
      21  libwidget_mac.dylib                 0x11122f02 nsBaseAppShell::NativeEventCallback() + 98
  23.
      22  libwidget_mac.dylib                 0x110edd6e nsAppShell::ProcessGeckoEvents(void*) + 750
  24.
      23  com.apple.CoreFoundation            0x93741595 CFRunLoopRunSpecific + 3141
  25.
      24  com.apple.CoreFoundation            0x93741c78 CFRunLoopRunInMode + 88
  26.
      25  com.apple.HIToolbox                 0x9700d28c RunCurrentEventLoopInMode + 283
  27.
      26  com.apple.HIToolbox                 0x9700cfde ReceiveNextEventCommon + 175
  28.
      27  com.apple.HIToolbox                 0x9700cf19 BlockUntilNextEventMatchingListInMode + 106
  29.
      28  com.apple.AppKit                    0x90565d0d _DPSNextEvent + 657
  30.
      29  com.apple.AppKit                    0x905655c0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
  31.
      30  com.apple.AppKit                    0x9055e5fb -[NSApplication run] + 795
  32.
      31  libwidget_mac.dylib                 0x110ed90a nsAppShell::Run() + 186
  33.
      32  libtoolkitcomps.dylib               0x0079f7c7 nsAppStartup::Run() + 71
  34.
      33  XUL                                 0x0003ae59 XRE_main + 13417
  35.
      34  org.mozilla.firefox                 0x00002d17 main + 231
  36.
      35  org.mozilla.firefox                 0x000025a2 _start + 216
  37.
      36  org.mozilla.firefox                 0x000024c9 start + 41

Comment 1

[Peter Van der Beken [:peterv]]

Attachment: v1

Possible patch.

Comment 2

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090706 Minefield/3.6a1pre ID:20090706042748

crashes on win32 too
bp-2e987ac2-2032-43c1-9352-e26522090706

doesn't matter if the html5 parser is enabled or not

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 386986 [details] [diff] [review]
v1

This fixes the crash.

Comment 4

[Peter Van der Beken [:peterv]]

http://hg.mozilla.org/mozilla-central/rev/e83a66661e8c

Comment 5

[Robert Sayre]

where's the test?

Comment 6

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090706 Minefield/3.6a1pre ID:20090706100853

verified/fixed on win32

Comment 7

[Benjamin Smedberg]

Please, this is the kind of thing that really needs an automated test.

Comment 10

[Ryan Fry]

Fixed on the Linux Ubuntu 9.04 i686 build.

Comment 11

[Tony Chung [:tchung]]

Verified fix on:
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2a1pre)
Gecko/20090707 Minefield/3.6a1pre
and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre)
Gecko/20090707 Minefield/3.6a1pre
and Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20090707
Minefield/3.6a1pre

Comment 12

[Peter Van der Beken [:peterv]]

http://hg.mozilla.org/mozilla-central/rev/a60b78ae0793