153783 - nsDOMWindowList::Item triggers index of child element is out of range! in mDocShellNode->GetChildAt(aIndex, getter_AddRefs(item))

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P4)

Description

[timeless]

###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && 
aIndex < mChildren.Count()', file 
f:\build\mozilla\docshell\base\nsDocShell.cpp, line 2057
Break: at file f:\build\mozilla\docshell\base\nsDocShell.cpp, line 2057

NTDLL! 77fa018c()
nsDebug::Assertion(const char * 0x02051498, const char * 0x0205146c, const char 
* 0x0205143c, int 2057) line 280 + 13 bytes
nsDebug::WarnIfFalse(const char * 0x02051498, const char * 0x0205146c, const 
char * 0x0205143c, int 2057) line 397 + 21 bytes
nsDocShell::GetChildAt(nsDocShell * const 0x03390210, int 0, 
nsIDocShellTreeItem * * 0x0012e900) line 2057 + 49 bytes
nsDOMWindowList::Item(nsDOMWindowList * const 0x034c89b0, unsigned int 0, 
nsIDOMWindow * * 0x0012e968) line 142 + 46 bytes
nsWindowSH::GetProperty(nsWindowSH * const 0x0338efb8, 
nsIXPConnectWrappedNative * 0x03391158, JSContext * 0x03390958, JSObject * 
0x03349330, long 1, long * 0x0012f198, int * 0x0012e9a0) line 2880 + 53 bytes
XPC_WN_Helper_GetProperty(JSContext * 0x03390958, JSObject * 0x03349330, long 
1, long * 0x0012f198) line 784 + 47 bytes
js_GetProperty(JSContext * 0x03390958, JSObject * 0x03349330, long 1, long * 
0x0012f198) line 2469 + 289 bytes
js_Interpret(JSContext * 0x03390958, long * 0x0012f314) line 2591 + 1981 bytes
js_Invoke(JSContext * 0x03390958, unsigned int 1, unsigned int 2) line 805 + 13 
bytes
js_InternalInvoke(JSContext * 0x03390958, JSObject * 0x03349330, long 58506664, 
unsigned int 0, unsigned int 1, long * 0x0012f56c, long * 0x0012f43c) line 880 
+ 20 bytes
JS_CallFunctionValue(JSContext * 0x03390958, JSObject * 0x03349330, long 
58506664, unsigned int 1, long * 0x0012f56c, long * 0x0012f43c) line 3428 + 31 
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x033907c0, void * 
0x03349330, void * 0x037cbda8, unsigned int 1, void * 0x0012f56c, int * 
0x0012f570, int 0) line 1042 + 33 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x0368f600, 
nsIDOMEvent * 0x0369c9a0) line 182 + 77 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x035aa198, 
nsIDOMEvent * 0x0369c9a0, nsIDOMEventTarget * 0x033906b8, unsigned int 2, 
unsigned int 7) line 1221 + 20 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x036e5dd0, 
nsIPresContext * 0x035c6078, nsEvent * 0x0012fd08, nsIDOMEvent * * 0x0012fcc8, 
nsIDOMEventTarget * 0x033906b8, unsigned int 7, nsEventStatus * 0x0012fd30) 
line 1965 + 36 bytes
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x033906a8, 
nsIPresContext * 0x035c6078, nsEvent * 0x0012fd08, nsIDOMEvent * * 0x0012fcc8, 
unsigned int 1, nsEventStatus * 0x0012fd30) line 736
PresShell::FireResizeEvent() line 3106
PresShell::sResizeEventCallback(nsITimer * 0x033cba20, void * 0x02bda3e0) line 
3086
nsTimerImpl::Fire() line 339 + 17 bytes
nsTimerManager::FireNextIdleTimer(nsTimerManager * const 0x018356b8) line 588
nsAppShell::Run(nsAppShell * const 0x00d38768) line 134
nsAppShellService::Run(nsAppShellService * const 0x00d39078) line 458
main1(int 3, char * * 0x00304420, nsISupports * 0x00000000) line 1456 + 32 
bytes
main(int 3, char * * 0x00304420) line 1805 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e8d326()

	aIndex	0
from nsDocShell::GetChildAt
-	mChildren	{...}
|+	__vfptr	0x100df678 const  nsVoidArray::`vftable'
\+	mImpl	0x00000000

Steps: get a broken chatzilla, try to run chatzilla.

you'll know you have a broken chatzilla if you get:
WARNING: chrome: failed to get base url for 
chrome://chatzilla/locale/chatzillaOverlay.dtd -- using wacky default, file
f:\build\mozilla\rdf\chrome\src\nsChromeRegistry.cpp, line 552
and you have a chatzilla.jar, and installed-chrome.txt has the correct mapping, 
and the resolved jar:resource: url works.
(you'll also get junk at the bottom of navigator's chrome because the chatzilla 
overlay will generate an error).

loading chatzilla will give you
WARNING: chrome: failed to get base url for 
chrome://chatzilla/locale/chatzilla.dtd -- using wacky default, file 
f:\build\mozilla\rdf\chrome\src\nsChromeRegistry.cpp, line 552
WARNING: chrome: failed to get base url for 
chrome://chatzilla/locale/chatzilla.properties -- using wacky default, file
f:\build\mozilla\rdf\chrome\src\nsChromeRegistry.cpp, line 552
-*- chatzilla: caught exception getting value for ``commaSpace''
[Exception... "Component returned failure code: 0x80520012 
(NS_ERROR_FILE_NOT_FOUND) [nsIStringBundle.formatStringFromName]"  nsresult: 
"0x80520012 (NS_ERROR_FILE_NOT_FOUND)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 885"  data: no]
<top>
getMsg@893
[anonymous]@33
-*- chatzilla: caught exception getting value for ``none''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@34
-*- chatzilla: caught exception getting value for ``unknown''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@35
-*- chatzilla: caught exception getting value for ``defaultNick''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@37
-*- chatzilla: caught exception getting value for ``responseCodeMapHello''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@76
-*- chatzilla: caught exception getting value for ``responseCodeMapHelp''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@77
-*- chatzilla: caught exception getting value for ``responseCodeMapUsage''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@78
-*- chatzilla: caught exception getting value for ``responseCodeMapError''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@79
-*- chatzilla: caught exception getting value for ``responseCodeMapWarning''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@80
-*- chatzilla: caught exception getting value for ``responseCodeMapInfo''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@81
-*- chatzilla: caught exception getting value for ``responseCodeMapEvalIn''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@82
-*- chatzilla: caught exception getting value for ``responseCodeMapEvalOut''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@83
-*- chatzilla: caught exception getting value for ``clientname''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@97
-*- chatzilla: caught exception getting value for ``circnetworkInitialDesc''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.GetStringFromName]"  nsresult: 
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 888"  data: no]
<top>
getMsg@893
[anonymous]@109
-*- chatzilla: caught exception getting value for ``circserverVersionRply''
[Exception... "Component returned failure code: 0x8000ffff 
(NS_ERROR_UNEXPECTED) [nsIStringBundle.formatStringFromName]"
  nsresult: "0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame :: 
chrome://chatzilla/content/static.js :: getMsg :: line 877"  data: no]
<top>
getMsg@893
[anonymous]@117
WARNING: chrome: failed to get base url for 
chrome://chatzilla/locale/chatzilla.dtd -- using wacky default, file 
f:\build\mozilla\rdf\chrome\src\nsChromeRegistry.cpp, line 552
WARNING: chrome: failed to get base url for 
chrome://chatzilla/locale/chatzillaOverlay.dtd -- using wacky default, file
f:\build\mozilla\rdf\chrome\src\nsChromeRegistry.cpp, line 552
WARNING: chrome: failed to get base url for 
chrome://chatzilla/locale/chatzilla.dtd -- using wacky default, file 
f:\build\mozilla\rdf\chrome\src\nsChromeRegistry.cpp, line 552
Document chrome://chatzilla/content/chatzilla.xul loaded successfully
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && 
aIndex < mChildren.Count()', file 
f:\build\mozilla\docshell\base\nsDocShell.cpp, line 2057
Break: at file f:\build\mozilla\docshell\base\nsDocShell.cpp, line 2057

Comment 1

[timeless]

Attachment: check length before calling getchildat

Comment 2

[Johnny Stenback (:jst)]

Mass-reassigning bugs to [e-mail]

Comment 3

[Fabian Guisset]

Hey timeless dude, is this still relevant? :-)

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 88883 [details] [diff] [review]
check length before calling getchildat

I'm against doing this. This adds code to check something that's kinda not
necessary when we could just eliminate the warning and simply say that it's ok
to ask for a while past the last existing child, you simply get null back. If
someone really wants a warning there, they're free to code up a
no-cost-in-release-builds warning and have at it.

Comment 5

[Jesse Ruderman]

This assertion can be triggered with

javascript:window[0]; void 0

on a non-framed page.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix the assertion

We might as well make this not assert, since SafeElementAt does the right thing. Also, I removed the two printfs that would show up, even in release builds.

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 212288 [details] [diff] [review]
Fix the assertion

r+sr=jst

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 9

[Jesse Ruderman]

Verified fixed, at least for comment 5.  There might still be a bug in Chatzilla that causes this code (now a warning) to be triggered.

Comment 10

[Jesse Ruderman]

I filed bug 328398 for the warnings appearing three times instead of once with the stpes in comment 5.