111548 - Crash from examining document.cookie properties from file:///

Status: VERIFIED DUPLICATE of bug 110560

(Core :: Networking: Cookies, defect)

Description

[Alex Vincent [:WeirdAl]]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.6+) Gecko/20011122
BuildID:    Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.6+) Gecko/20011122

In building a testcase for bug 111536, I happened on a reproducible crash. 
Don't know why yet, except it involves document.cookie.

Reproducible: Always
Steps to Reproduce:
1.  Run attached testcase (second attachment, first attachment has the crasher)
2.
3.

Actual Results:  Crash -- talkback ID TB38398703Z, TB38392714H

Expected Results:  Mozilla continues on its merry way, reporting zero properties
for document.cookie.

The second testcase references two files from bug 111536, attachments 58923 and
58924.

cc'ing stephend for the talkback data.

Comment 1

[Alex Vincent [:WeirdAl]]

Attachment: Testcase, part 1 or 2

Comment 2

[[e-mail] (gone - use [e-mail] instead)]

Stack Signature COOKIE_GetCookie bc847af0 
Bug ID  
Trigger Time 2001-11-22 22:41:08 
Email Address  
URL visited  
User Comments Successfully reproduced crash involving document.cookie and bug 
111536 testcase.  
Build ID 2001112210 
Product ID MozillaTrunk 
Platform  
Operating System Win32 
Module  
Trigger Reason Access violation 
Stack Trace  
COOKIE_GetCookie [d:\builds\seamonkey\mozilla\extensions\cookie\nsCookies.cpp, 
line 654] 
nsCookieService::GetCookieString 
[d:\builds\seamonkey\mozilla\extensions\cookie\nsCookieService.cpp, line 163] 
nsHTMLDocument::GetCookie 
[d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLDocument.cpp, line 
1990] 
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 154] 
XPCWrappedNative::CallMethod 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 
2011] 
XPC_WN_GetterSetter 
[d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, 
line 1299] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 834] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 925] 
js_GetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2448] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2643] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 850] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 925] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3407] 
nsJSContext::CallEventHandler 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 991] 
nsJSEventListener::HandleEvent 
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 182] 
nsEventListenerManager::HandleEventSubType 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, 
line 1214] 
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, 
line 1889] 
GlobalWindowImpl::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 636] 
DocumentViewerImpl::LoadComplete 
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 1180] 
nsDocShell::EndPageLoad 
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3352] 
nsWebShell::EndPageLoad 
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 918] 
nsDocShell::OnStateChange 
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3260] 
nsDocLoaderImpl::FireOnStateChange 
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 1110] 
nsDocLoaderImpl::doStopDocumentLoad 
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 749] 
nsDocLoaderImpl::DocLoaderIsEmpty 
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 647] 
nsDocLoaderImpl::OnStopRequest 
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 578] 
nsLoadGroup::RemoveRequest 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 530] 
PresShell::RemoveDummyLayoutRequest 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6408] 
PresShell::ProcessReflowCommands 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6185] 
ReflowEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5969] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 1072] 
KERNEL32.DLL + 0x24407 (0xbff94407) 
0x00688bfe 

Comment 3

[Alex Vincent [:WeirdAl]]

Attachment: Testcase, part 2 of 2

That was exceptionally fast, Stephen!  Thanks!

Comment 4

[Alex Vincent [:WeirdAl]]

Attachment: Testcase, local version, zipped

Great, I can't reproduce the crash using the online testcases, but my local
copy crashes every time.  Try downloading and unzipping the above attachment,
then open docPropFSet.html in your browser.

Comment 5

[Stephen P. Morse]

Tried unzipping the last attachment and then loading it into a browser window as 
per above instructions.  Did not observe any crash.  Instead window seemed to 
display fine.

Comment 6

[Alex Vincent [:WeirdAl]]

Attachment: cookies.txt (caused crash TB38422351X)

Incorrectly labeled the crash talkback data against 111518.

Comment 7

[Alex Vincent [:WeirdAl]]

My exact settings in Edit, Preferences, Privacy & Security, Cookies:
* Enable cookies for the originating web site only.
Warn me before storing a cookie (unchecked)
Limit maximum lifetime of cookies to (unchecked)

Comment 8

[basic]

with build 2001112104 win32 trunk installer (full) on w2k I can't seem to crash
this.

Looking at the talkback, it seems to crash at the same line as bug 110560

see http://bugzilla.mozilla.org/show_bug.cgi?id=110560#c1

and http://lxr.mozilla.org/mozilla/source/extensions/cookie/nsCookies.cpp#654

the line numbers don't match but the code seems to.

Comment 9

[Stephen P. Morse]

So let me see if I understand what the steps are to reproduce this crash.

1. Unzip attachment 58943 [details] and store it in a directory on local disk
2. Fetch attachment 59008 [details] and place it in profile directory as cookies.txt
3. Start browser (browser was not running during step 2)
4. Open docPropFSet.html from local disk (installed in step 1)
5. Browser will crash

Well it doesn't crash for me.  Reporter, can you demonstrate the crash starting 
with a fresh profile?

Comment 10

[Stephen P. Morse]

Yes, this is certainly a dup of bug 110560, which I also can't reproduce.

*** This bug has been marked as a duplicate of 110560 ***

Comment 11

[benc]

VERIFIED/dupe: i know this works in Mozilla 1.4b