166328 - Blank page and uncaught exception nsIDOMNSHTMLDocument.writeln error in JS console when page calls javascript from frame src

Status: RESOLVED DUPLICATE of bug 217000

(Core :: DOM: HTML Parser, defect)

Description

[Ian Neal]

Netscape Messenger Server 4.15 gives an HTML enduser admin interface that works
fine in IE and NS4.x but in Mozilla (Build 2002080508 and 2002083108 on WinXP)
the following error messages in the JS console:

Error: unterminated regular expression literal
Source File: javascript://top.output_top_frame()/;
Line: 1
Source Code:
/;
Error: unterminated regular expression literal
Source File: javascript://top.output_bottom_frames()/;
Line: 1
Source Code:
/;

I'll attach the HTML

Comment 1

[Ian Neal]

Attachment: EndUser source from NS Messenger

Comment 2

[Ian Neal]

This may well be related to bug 127656 so adding dependency. 

Comment 3

[Ian Neal]

Adding regression keyword. Tested on WinXP, some previous builds:
2002032803, 2002040203 and 2002041620 display the page but throbber keeps throbbing
2002042608 doesn't display the page and gives the following error messages in
the JS console:
Error: uncaught exception: [Exception... "Component returned failure code:
0x80004003 (NS_ERROR_INVALID_POINTER) [nsIDOMNSHTMLDocument.writeln]"  nsresult:
"0x80004003 (NS_ERROR_INVALID_POINTER)"  location: "JS frame ::
http://adm1:5000/bin/user/admin/bin/enduser :: output_top_frame :: line 4" 
data: no]
Error: uncaught exception: [Exception... "Component returned failure code:
0x80004003 (NS_ERROR_INVALID_POINTER) [nsIDOMNSHTMLDocument.writeln]"  nsresult:
"0x80004003 (NS_ERROR_INVALID_POINTER)"  location: "JS frame ::
http://adm1:5000/bin/user/admin/bin/enduser :: output_bottom_frames :: line 12"
 data: no]

Comment 4

[Ian Neal]

The new version of the error message (unterminated...) only starts occuring in
BuildID 2002083108, prior to that from that you get the uncaught exception error
message.

Comment 5

[Ian Neal]

When a nightly gets spun that contains the fix to bug 166175, I'll see what the
error messages are then.

Comment 6

[Ian Neal]

The error messages are back to:
Error: uncaught exception: [Exception... "Component returned failure code:
0x80004003 (NS_ERROR_INVALID_POINTER) [nsIDOMNSHTMLDocument.writeln]"  nsresult:
"0x80004003 (NS_ERROR_INVALID_POINTER)"  location: "JS frame ::
http://adm1:5000/bin/user/admin/bin/enduser :: output_top_frame :: line 4" 
data: no]
and
Error: uncaught exception: [Exception... "Component returned failure code:
0x80004003 (NS_ERROR_INVALID_POINTER) [nsIDOMNSHTMLDocument.writeln]"  nsresult:
"0x80004003 (NS_ERROR_INVALID_POINTER)"  location: "JS frame ::
http://adm1:5000/bin/user/admin/bin/enduser :: output_bottom_frames :: line 12"
 data: no]

Updating summary to reflect that and removing dependency on bug 127656

Comment 7

[Ian Neal]

This probably DOM level 0 so reassigning

Comment 8

[Ian Neal]

Updating summary

Comment 9

[Ian Neal]

Attachment: Simplified Test Case

Comment 10

[Ian Neal]

Added simplified test case and tweaked summary to help catch dupes

Comment 11

[Ian Neal]

*** Bug 175117 has been marked as a duplicate of this bug. ***

Comment 12

[Ian Neal]

Happens on Linux -> OS to All
From dupe regression happened somewhere between 1.0.1 and 1.1

Comment 13

[Ian Neal]

Adding testcase and 4xp keywords

Comment 14

[jeff burka]

Amusingly, trying to click on the Simplified Test Case attachment from 12/16
triggers this error in moz 1.2.1.  It would appear that bugzilla is trying to
make use of the same type of functionality:

Error: uncaught exception: [Exception... "Component returned failure code:
0x80004003 (NS_ERROR_INVALID_POINTER) [nsIDOMNSHTMLDocument.writeln]"  nsresult:
"0x80004003 (NS_ERROR_INVALID_POINTER)"  location: "JS frame ::
http://bugzilla.mozilla.org/attachment.cgi?id=97583&action=view ::
output_top_frame :: line 4"  data: no]

This bug continues to not be present in the 1.0.x branch; 1.0.3 seems fine.  The
most recent nightly I tried (1.3b, 2/20/03) is still failing.

Comment 15

[Johnny Stenback (:jst)]

Mass-reassigning bugs to [e-mail]

Comment 16

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Harish, does this have anything to do with parsing?

Comment 17

[Samir Gehani]

adt: nsbeta1-

Comment 18

[Ian Neal]

Using a debug bug on linux and going to this page produces the following output
prior to generating the JS console message:
###!!! ASSERTION: Null ptr!: 'Error', file nsHTMLContentSink.cpp, line 2437
Break: at file nsHTMLContentSink.cpp, line 2437
###!!! ASSERTION: RemoveElementsAt(negative index): 'aIndex >= 0', file
nsVoidArray.cpp, line 561
Break: at file nsVoidArray.cpp, line 561
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file nsHTMLDocument.cpp, line
2594

Adding jst to cc list as this bit of code shows up as his in CVS blame and it's
not present in Mozilla 1.0.x which doesn't have this problem.

Comment 19

[Ian Neal]

Attachment: Gzipped backtrace file

Backtrace from attaching gdb to running debug version of mozilla-bin process
and setting breakpoint to be nsHTMLContentSink.cpp:2437

Comment 20

[Ian Neal]

pushing across to parser as it's not DOM0 or Layout

Comment 21

[Ian Neal]

Attachment: Ungzipped version of backtrace file

For those that prefer it that way

Comment 22

[Ian Neal]

Looks like HTMLContentSink::Init is called with aContainer being null this comes
from NS_NewHTMLContentSink which is called from nsHTMLDocument::OpenCommon.
The relevant lines in nsHTMLDocument.cpp seem to be
http://lxr.mozilla.org/seamonkey/source/content/html/document/src/nsHTMLDocument.cpp#2521

Comment 23

[Ian Neal]

Not sure if it's related to bug 96108 but rjesup seems to be in the CVS blame
for SafeElementAt so cc'ing

Comment 24

[Ian Neal]

Attachment: Testcase in plain text so it can be read

Comment 25

[Egbert de Smet]

Attachment: plain text example to bug 166328

The page below does not display with latest Mozilla browsers and yields the
'uncaught exception...' error, the problem being that nothing can be written to
the 'with top.main.document' object :

<HTML>
<HEAD>
<TITLE>Frametest with JavaScript</TITLE>
<SCRIPT>

function rightFrame() {
with (top.main.document) {
write('<HTML><HEAD><TITLE>Javascript frametest</TITLE></HEAD>
<BODY>this is the right frame</BODY></HTML>');
}
}

</SCRIPT>
</HEAD>

<FRAMESET COLS="27%,*" BORDER=2>
<FRAME SRC="left.htm" NAME="leftFrame">
<FRAME SRC="Javascript:top.rightFrame();" NAME="main">
</FRAMESET>
</HTML>

Comment 26

[Ian Neal]

Attachment: Recent back trace from win32 build

Comment 27

[Ian Neal]

When we try and get the docshell of our primary presentation shell, we're
getting a null rather than a docshell, relevant line at the moment is:

http://lxr.mozilla.org/seamonkey/source/content/html/document/src/nsHTMLDocument.cpp#2491

Comment 28

[Ian Neal]

Attachment: Revised testcase

Revised test case that doesn't give any 404 errors, plain text version below:

<head><title>Testcase for bug 163328</title><meta http-equiv=Content-Type
content=text/html; charset=UTF-8></head>
<SCRIPT language=JavaScript>
function output_top_frame()  {
   top.title.document.writeln("Top Frame<BR>");
}
function output_bottom_frames()  {
    top.bottom.document.writeln("Bottom Frame<BR>");
}
</script>

<frameset rows="60,1*" border=0 framespacing=0 frameborder=0 framepadding=0
marginwidth=0 marginheight=0>
<frame src="javascript:top.output_top_frame();" marginheight=0 marginwidth=0
scrolling=no noresize frameborder=no name=title>
<frame src="javascript:top.output_bottom_frames();" marginheight=0
marginwidth=0 scrolling="no" name=bottom>
</frameset>

Comment 29

[Ian Neal]

This regression has just been fixed by patch to bug 217000, so we're now back to
the position of around BuildID 2002041620 where the throbber/progress bar keeps
going but the page loads. This resultant problem is a fairly trivial one and I
expect has or will be spun off into a separate bug.

Now this regression has been fixed it means there is one less barrier to rolling
out mozilla into an enterprise environment that uses a Netscape/iPlanet
Messaging Server.

*** This bug has been marked as a duplicate of 217000 ***

Comment 30

[Ian Neal]

I suspect the outstanding issue is bug 143398 or related to it.

Yes, I know I got dyslexic with the bug number in the page title of my testcase!