15879 - Crash while viewing FileUpload object value

Status: VERIFIED WORKSFORME

(SeaMonkey :: General, defect, P2)

Description

[ppandit]

Using a debug build from Oct. 5 on Windows NT

1) Load a JavaScript sample file (see attachment)
2) Load a file from CD-ROM
3) Press ViewValue button = works okay by displaying the name of the file in an
alert window
4) Close alert window
5) Press ViewValue button again => crash
"Unhandled Exception in apprunner.exe (RAPTORWEB.DLL) 0xC0000005"

Here is the trace:

nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x0439de30, nsIChannel
* 0x0439efc0, unsigned int 2152398850) line 869 + 25 bytes
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x0439de34, nsIChannel *
0x00000000, nsISupports * 0x00000000, unsigned int 2152398850, const unsigned
short * 0x00000000) line 753
nsLoadGroup::Cancel(nsLoadGroup * const 0x0439ddc0) line 326 + 44 bytes
nsDocLoaderImpl::Stop(nsDocLoaderImpl * const 0x0439de30) line 584 + 26 bytes
nsWebShell::Stop(nsWebShell * const 0x0439d3e0) line 2345
nsWebShell::Destroy(nsWebShell * const 0x0439d3e0) line 1146
nsGfxTextControlFrame::~nsGfxTextControlFrame() line 250
nsGfxTextControlFrame::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsFrame::Destroy(nsFrame * const 0x0438cc70, nsIPresContext & {...}) line 353 +
34 bytes
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x03adcba8, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrames(nsIPresContext & {...}) line 29
nsContainerFrame::Destroy(nsContainerFrame * const 0x03adb090, nsIPresContext &
{...}) line 88
nsFrameList::DestroyFrame(nsIPresContext & {...}, nsIFrame * 0x03adb090) line
115
nsBoxFrame::RemoveFrame(nsBoxFrame * const 0x03ad5f48, nsIPresContext & {...},
nsIPresShell & {...}, nsIAtom * 0x00000000, nsIFrame * 0x03adb090) line 1388
FrameManager::RemoveFrame(FrameManager * const 0x04314dd0, nsIPresContext &
{...}, nsIPresShell & {...}, nsIFrame * 0x03ad5f48, nsIAtom * 0x00000000,
nsIFrame * 0x03adb090) line 532
nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x04312e60,
nsIPresContext * 0x04313040, nsIContent * 0x0429b620, nsIContent * 0x043373f0,
int 2) line 6411 + 58 bytes
nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext * 0x04313040,
nsIContent * 0x043373f0) line 7814 + 28 bytes
nsCSSFrameConstructor::AttributeChanged(nsCSSFrameConstructor * const
0x04312e60, nsIPresContext * 0x04313040, nsIContent * 0x043373f0, nsIAtom *
0x00fe7df0, int 2) line 6951 + 16 bytes
StyleSetImpl::AttributeChanged(StyleSetImpl * const 0x04312f00, nsIPresContext *
0x04313040, nsIContent * 0x043373f0, nsIAtom * 0x00fe7df0, int -1) line 923
PresShell::AttributeChanged(PresShell * const 0x04312d58, nsIDocument *
0x04322910, nsIContent * 0x043373f0, nsIAtom * 0x00fe7df0, int -1) line 1719 +
53 bytes
XULDocumentImpl::AttributeChanged(XULDocumentImpl * const 0x04322910, nsIContent
* 0x043373f0, nsIAtom * 0x00fe7df0, int -1) line 1733
RDFElementImpl::SetAttribute(RDFElementImpl * const 0x043373f0, int 0, nsIAtom *
0x00fe7df0, const nsString & {...}, int 1) line 2453
RDFElementImpl::SetAttribute(RDFElementImpl * const 0x043373e0, const nsString &
{...}, const nsString & {...}) line 1275 + 35 bytes
ElementSetAttribute(JSContext * 0x04271860, JSObject * 0x026f1638, unsigned int
2, long * 0x03acb0ec, long * 0x0012cda0) line 258 + 26 bytes
js_Invoke(JSContext * 0x04271860, unsigned int 2, unsigned int 0) line 671 + 26
bytes
js_Interpret(JSContext * 0x04271860, long * 0x0012d618) line 2249 + 15 bytes
js_Invoke(JSContext * 0x04271860, unsigned int 0, unsigned int 0) line 687 + 13
bytes
js_Interpret(JSContext * 0x04271860, long * 0x0012de4c) line 2249 + 15 bytes
js_Invoke(JSContext * 0x04271860, unsigned int 1, unsigned int 2) line 687 + 13
bytes
js_InternalCall(JSContext * 0x04271860, JSObject * 0x024fbeb0, long 32745064,
unsigned int 1, long * 0x0012dfcc, long * 0x0012df84) line 764 + 15 bytes
JS_CallFunction(JSContext * 0x04271860, JSObject * 0x024fbeb0, JSFunction *
0x0429c2e0, unsigned int 1, long * 0x0012dfcc, long * 0x0012df84) line 2650 + 32
bytes
nsJSContext::CallFunction(nsJSContext * const 0x04276cf0, void * 0x024fbeb0,
void * 0x0429c2e0, unsigned int 1, void * 0x0012dfcc, int * 0x0012dfc8) line 231
+ 39 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x0439df00) line 103 + 48 bytes
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012e324, nsIDOMEvent * * 0x0012e1cc, unsigned int 7, nsEventStatus &
nsEventStatus_eIgnore) line 1025 + 21 bytes
GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x042716b4,
nsIPresContext & {...}, nsEvent * 0x0012e324, nsIDOMEvent * * 0x0012e1cc,
unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 2784
nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x04297a64, nsIDocumentLoader *
0x04291d80, nsIChannel * 0x04374760, unsigned int 0, nsIDocumentLoaderObserver *
0x04297a64) line 3383 + 34 bytes
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x04291d80, nsIChannel
* 0x04374760, unsigned int 0) line 870
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x04291d84, nsIChannel *
0x04392a10, nsISupports * 0x00000000, unsigned int 0, const unsigned short *
0x00000000) line 753
nsLoadGroup::RemoveChannel(nsLoadGroup * const 0x04294e40, nsIChannel *
0x04392a10, nsISupports * 0x00000000, unsigned int 0, const unsigned short *
0x00000000) line 597 + 39 bytes
nsFileChannel::OnStopRequest(nsFileChannel * const 0x04392a14, nsIChannel *
0x04392f30, nsISupports * 0x00000000, unsigned int 0, const unsigned short *
0x00000000) line 417
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x0439d820) line
283
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x0439dc60) line 152 + 12 bytes
PL_HandleEvent(PLEvent * 0x0439dc60) line 541 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x04290fd0) line 500 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x002002f2, unsigned int 49409, unsigned int 0,
long 69799888) line 970 + 9 bytes
USER32! DispatchMessageWorker@8 + 135 bytes
USER32! DispatchMessageA@4 + 11 bytes
nsAppShell::DispatchNativeEvent(nsAppShell * const 0x04322760, int 1, void *
0x01169620 msg) line 206
nsWebShellWindow::ShowModalInternal(nsWebShellWindow * const 0x04297f50) line
1784
nsWebShellWindow::ShowModal(nsWebShellWindow * const 0x04297f50) line 1750 + 9
bytes
nsWebShellWindow::ShowModally(nsWebShellWindow * const 0x04297f58, int 0) line
1812 + 16 bytes
GlobalWindowImpl::OpenInternal(JSContext * 0x031ffeb0, long * 0x0250ff58,
unsigned int 4, int 1, nsIDOMWindow * * 0x0012e8dc) line 2046
GlobalWindowImpl::OpenDialog(GlobalWindowImpl * const 0x031fd1d8, JSContext *
0x031ffeb0, long * 0x0250ff58, unsigned int 4, nsIDOMWindow * * 0x0012e8dc) line
1916
nsCommonDialogs::DoDialog(nsCommonDialogs * const 0x04471040, nsIDOMWindow *
0x031fd1d8, nsIDialogParamBlock * 0x04291ac0, const char * 0x00ef3cc4) line 296
+ 29 bytes
nsCommonDialogs::Alert(nsCommonDialogs * const 0x04471040, nsIDOMWindow *
0x031fd1d8, const unsigned short * 0x00000000, const unsigned short *
0x0012e9c0) line 110 + 27 bytes
nsWebShellWindow::Alert(nsWebShellWindow * const 0x031ff438, const unsigned
short * 0x0012e9c0) line 2950 + 27 bytes
GlobalWindowImpl::Alert(GlobalWindowImpl * const 0x035bf328, JSContext *
0x035bf160, long * 0x02670cd0, unsigned int 1) line 1093 + 31 bytes
WindowAlert(JSContext * 0x035bf160, JSObject * 0x025c7288, unsigned int 1, long
* 0x02670cd0, long * 0x0012eb40) line 1061 + 27 bytes
js_Invoke(JSContext * 0x035bf160, unsigned int 1, unsigned int 0) line 671 + 26
bytes
js_Interpret(JSContext * 0x035bf160, long * 0x0012f3b8) line 2249 + 15 bytes
js_Invoke(JSContext * 0x035bf160, unsigned int 1, unsigned int 2) line 687 + 13
bytes
js_InternalCall(JSContext * 0x035bf160, JSObject * 0x024fb350, long 38777688,
unsigned int 1, long * 0x0012f538, long * 0x0012f4f0) line 764 + 15 bytes
JS_CallFunction(JSContext * 0x035bf160, JSObject * 0x024fb350, JSFunction *
0x03636570, unsigned int 1, long * 0x0012f538, long * 0x0012f4f0) line 2650 + 32
bytes
nsJSContext::CallFunction(nsJSContext * const 0x035bf2d0, void * 0x024fb350,
void * 0x03636570, unsigned int 1, void * 0x0012f538, int * 0x0012f534) line 231
+ 39 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x0428d270) line 103 + 48 bytes
nsEventListenerManager::HandleEvent(nsIPresContext & {...}, nsEvent *
0x0012f7b0, nsIDOMEvent * * 0x0012f73c, unsigned int 7, nsEventStatus &
nsEventStatus_eIgnore) line 646 + 21 bytes
nsGenericElement::HandleDOMEvent(nsIPresContext & {...}, nsEvent * 0x0012f7b0,
nsIDOMEvent * * 0x0012f73c, unsigned int 1, nsEventStatus &
nsEventStatus_eIgnore) line 794
nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x03634f5c,
nsIPresContext & {...}, nsEvent * 0x0012f7b0, nsIDOMEvent * * 0x00000000,
unsigned int 1, nsEventStatus & nsEventStatus_eIgnore) line 550 + 31 bytes
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x036388d0, nsIPresContext & {...}, nsMouseEvent * 0x0012fbf0, nsEventStatus &
nsEventStatus_eIgnore) line 1003 + 42 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x036388d0,
nsIPresContext & {...}, nsGUIEvent * 0x0012fbf0, nsIFrame * 0x0363d200,
nsEventStatus & nsEventStatus_eIgnore, nsIView * 0x036316a0) line 474 + 24 bytes
PresShell::HandleEvent(PresShell * const 0x031fd414, nsIView * 0x036316a0,
nsGUIEvent * 0x0012fbf0, nsEventStatus & nsEventStatus_eIgnore) line 2102 + 43
bytes
nsView::HandleEvent(nsView * const 0x036316a0, nsGUIEvent * 0x0012fbf0, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 834
nsView::HandleEvent(nsView * const 0x03630a30, nsGUIEvent * 0x0012fbf0, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x03630b10, nsGUIEvent * 0x0012fbf0, unsigned
int 8, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsView::HandleEvent(nsView * const 0x02d8ea10, nsGUIEvent * 0x0012fbf0, unsigned
int 28, nsEventStatus & nsEventStatus_eIgnore, int & 0) line 819
nsViewManager::DispatchEvent(nsViewManager * const 0x02d2a650, nsGUIEvent *
0x0012fbf0, nsEventStatus & nsEventStatus_eIgnore) line 1670
HandleEvent(nsGUIEvent * 0x0012fbf0) line 63
nsWindow::DispatchEvent(nsWindow * const 0x036308a4, nsGUIEvent * 0x0012fbf0,
nsEventStatus & nsEventStatus_eIgnore) line 342 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fbf0) line 363
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3306 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line
3524
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 5636171, long *
0x0012fe14) line 2533 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x00050278, unsigned int 514, unsigned int 0, long
5636171) line 520 + 27 bytes
USER32! DispatchMessageWorker@8 + 135 bytes
USER32! DispatchMessageA@4 + 11 bytes
nsAppShell::Run(nsAppShell * const 0x00d8d150) line 74
nsAppShellService::Run(nsAppShellService * const 0x00d07190) line 462
main1(int 1, char * * 0x00ca4ca0) line 590 + 12 bytes
main(int 1, char * * 0x00ca4ca0) line 701 + 13 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! BaseProcessStart@4 + 64 bytes

Comment 1

[ppandit]

Attachment: FileUpload example file

Comment 2

[Eli Goldberg]

JavaScript issue; QA Assigning to Prashant.

[Par, as you probably already know, bugs assigned to Browser-General are
investigated on a time-available basis; it's a good idea to send bugs to a more
specific component, or e-mail Don when you submit the bug to specifically request
that he process the bug.]

Comment 3

[don]

Bill, can you figure out whether this is our bug or not?

Comment 4

[Bill Law]

This doesn't crash for me using my build from today (11/16).  It looks like the
same bug as maybe the view-source bug (17500) that rick potts has fixed.

I do get some spurious "warning" alerts but I get those all over the place so I
think this problem is gone.  If it's still present, please re-open.  Note that
bug 17500 only manifested itself in certain scenarios (e.g., debug builds or on
slow machines).