20902 - File Selection Dialog causing crash later on exit

Status: VERIFIED FIXED

(Core :: XUL, defect, P2)

Description

[Mats Palmgren (inactive)]

DESCRIPTION:
Closing the File Selection Dialog window via the window manager menu, causes
a crash when quitting mozilla. It does not happen if the FS dialog is closed
with the "Cancel" button.

TO REPEAT:
1. start mozilla
2. invoke menu item File->Open File...
3. close the window that pops up via the window manager menu
4(a) invoke menu item File->Close
(Alt: 4(b) invoke menu item File->Quit)

ACTUAL RESULTS:
4(a) Crash, see stack trace below.
4(b) Mozilla does not quit and the following messages appears in the console:
Gtk-WARNING **: invalid unclassed pointer in cast to `GtkMenuShell'

Gtk-CRITICAL **: file gtkwidget.c: line 1394 (gtk_widget_destroy): assertion
`widget != NULL' failed.
JavaScript Error: uncaught exception: [Exception... "Component returned failure
code: 0x8052ffff [nsIFileSpecWithUI.chooseFile]"  nsresult: "0x8052ffff
(<unknown>)"  location: "JS frame :: chrome://navigator/content/navigator.js ::
BrowserOpenFileWindow :: line 922"  data: no]

BUILD AND PLATFORM BUG FOUND ON:
Mozilla nightly build 1999120509 on Sun/Solaris2.6/sparc

ADDITIONAL INFO:
Stack trace on Sun/Solaris2.6/sparc follows

t@1 (l@1) terminated by signal SEGV (no mapping at the fault address)
(dbx) where
current thread: t@1
=>[1] gtk_type_check_object_cast(0x75af80, 0xa715, 0xef7ed130, 0xef7ed118,
0xeef66ad0, 0xef7d0114), at 0xef6a598c
  [2] _12nsFileWidget(0x75af00, 0x3, 0xee07a1d4, 0xef7ed2b8, 0xef7ec9c0, 0x99),
at 0xee07a21c
  [3] Release__12nsFileWidget(0x75af00, 0xee079fcc, 0x75af00, 0x0, 0x0, 0x0), at
0xee07a004
  [4] _13nsCOMPtr_base(0xefffc678, 0x2, 0xefffc658, 0xefffc680, 0xee07ae74,
0x0), at 0xef436224
  [5] ChooseInputFile__20nsFileSpecWithUIImplPCcUiT1T1(0x75bd40, 0x76c360, 0x40,
0x0, 0x0, 0xee0944bc), at 0xee094608
  [6] ChooseFile__20nsFileSpecWithUIImplPCcPPc(0x75bd40, 0x76c360, 0xefffc8c0,
0x2d7e08, 0x33d740, 0x33d740), at 0xee094044
  [7] 0xef43d2f4(0x75bd40, 0x1f8, 0x2, 0xefffc8b0, 0x0, 0x0), at 0xef43d2f3
  [8]
CallWrappedMethod__23nsXPCWrappedNativeClassP9JSContextP18nsXPCWrappedNativePC25
XPCNativeMemberDescriptorQ223nsXPCWrappedNativeClass8CallModeUiPlT6(0x75f380,
0x336000, 0x75f580, 0x75e410, 0x0, 0x32f800), at 0xed416514
  [9] WrappedNative_CallMethod__FP9JSContextP8JSObjectUiPlT3(0x336000, 0x75f580,
0x1, 0x360058, 0xefffca8c, 0xed417688), at 0xed417774
  [10] js_Invoke(0x336000, 0x1, 0x0, 0x1, 0x7891f0, 0x0), at 0xef52f308
  [11] js_Interpret(0x336000, 0xefffccfc, 0x0, 0x336000, 0x4d75cf, 0xefffcd00),
at 0xef5352f8
  [12] js_Invoke(0x336000, 0x0, 0x0, 0x0, 0x2d7be0, 0x0), at 0xef52f35c
  [13] js_Interpret(0x336000, 0xefffcf8c, 0x0, 0x336000, 0x756f78, 0xefffcf90),
at 0xef5352f8
  [14] js_Invoke(0x336000, 0x1, 0x2, 0x1, 0x789130, 0x0), at 0xef52f35c
  [15] js_InternalCall(0x336000, 0x789130, 0x789140, 0x1, 0xefffd264,
0xefffd1ac), at 0xef52f544
  [16] JS_CallFunctionValue(0x336000, 0x789130, 0x789140, 0x1, 0xefffd264,
0xefffd1ac), at 0xef51559c
  [17] CallFunctionObject__11nsJSContextPvT1UiT1Pi(0x32cd40, 0x789130, 0x789140,
0x1, 0xefffd264, 0xefffd268), at 0xeed574a8
  [18] HandleEvent__17nsJSEventListenerP11nsIDOMEvent(0x636e60, 0x6f0a44,
0x636e60, 0xeed84dcc, 0xefffd434, 0xeed570b4), at 0xeed84f5c
  [19]
HandleEventSubType__22nsEventListenerManagerP16nsListenerStructP11nsIDOMEventUi(
0x0, 0x636ea0, 0x6f0a44, 0x8, 0x8, 0x6f0a44), at 0xeceb2c64
  [20]
HandleEvent__22nsEventListenerManagerP14nsIPresContextP7nsEventPP11nsIDOMEventUi
P13nsEventStatus(0x63c580, 0x2cbd00, 0xefffd7e0, 0xefffd754, 0x1, 0xefffd7dc),
at 0xeceb4270
  [21]
HandleDOMEvent__12nsXULElementP14nsIPresContextP7nsEventPP11nsIDOMEventUiP13nsEv
entStatus(0x5b2980, 0x2cbd00, 0xefffd7e0, 0x0, 0x1, 0xefffd7dc), at 0xedb1e2a0
  [22] Execute__11nsMenuFrame(0x740990, 0xefffdc28, 0x54d244, 0xefffd944, 0x2,
0xefffdc28), at 0xed064688
  [23]
HandleEvent__11nsMenuFrameP14nsIPresContextP10nsGUIEventP13nsEventStatus(0x74099
0, 0x2cbd00, 0xefffddf8, 0xefffdc28, 0xed06169c, 0xefffdc28), at 0xed061868
  [24] HandleEvent__9PresShellP7nsIViewP10nsGUIEventP13nsEventStatus(0x368000,
0x73c480, 0xefffddf8, 0xefffdc28, 0xecef2398, 0x0), at 0xecef2720
  [25] HandleEvent__6nsViewP10nsGUIEventUiP13nsEventStatusRi(0x73c480,
0xefffddf8, 0x8, 0xefffdc28, 0xefffdb60, 0xed3acedc), at 0xed3ad09c
  [26] HandleEvent__6nsViewP10nsGUIEventUiP13nsEventStatusRi(0x357480,
0xefffddf8, 0x1c, 0xefffdc28, 0xefffdb60, 0xed3acedc), at 0xed3ad020
  [27] DispatchEvent__13nsViewManagerP10nsGUIEventP13nsEventStatus(0x337c00,
0xefffddf8, 0xefffdc28, 0xed3b7e78, 0xff00, 0xefffdff8), at 0xed3b8468
  [28] 0xed3ab760(0xefffddf8, 0xed3ab714, 0x73d400, 0x0, 0xefffe088,
0xef748e5c), at 0xed3ab75f
  [29] DispatchEvent__8nsWidgetP10nsGUIEventR13nsEventStatus(0x73d400,
0xefffddf8, 0xefffdd14, 0xee0882ac, 0x696e00, 0x0), at 0xee088318
  [30] DispatchWindowEvent__8nsWidgetP10nsGUIEvent(0x73d400, 0xefffddf8,
0xef70cb64, 0xf0000000, 0x0, 0x0), at 0xee088228
  [31] DispatchMouseEvent__8nsWidgetR12nsMouseEvent(0x73d400, 0xefffddf8,
0x73d400, 0x73d400, 0x2bc000, 0x0), at 0xee0883d8
  [32] OnButtonReleaseSignal__8nsWidgetP15_GdkEventButton(0x73d400, 0x2bc018,
0xee08911c, 0xeef8f8e0, 0x0, 0x0), at 0xee089258
  [33] HandleGDKEvent__8nsWindowP9_GdkEvent(0x73d400, 0x2bc018, 0x0, 0xefffdf3c,
0x20, 0xaa800), at 0xee08c658
  [34] handle_gdk_event__FP9_GdkEventPv(0x2bc018, 0x0, 0xee07d070, 0x0, 0x0,
0x0), at 0xee07d1d4
  [35] 0xef6ecd24(0x2bc018, 0xefffe088, 0x0, 0x54a9b8, 0xff00, 0xefffdff8), at
0xef6ecd23
  [36] 0xef7045d0(0xef748c00, 0xef748c00, 0xef748c00, 0xef748e64, 0xefffe088,
0xef748e5c), at 0xef7045cf
  [37] 0xef704be0(0xef748c00, 0xef748c00, 0xef748c00, 0xef748e64, 0xef748c00,
0x1), at 0xef704bdf
  [38] g_main_run(0xf51c0, 0xef747800, 0x0, 0xc8, 0xef7ec9c0, 0xd), at
0xef704d68
  [39] gtk_main(0x0, 0x99780, 0x1, 0xee073b20, 0xef42a5d0, 0x0), at 0xef6711c8
  [40] Run__10nsAppShell(0xbfe60, 0xee0738f0, 0xbfe60, 0xeeccfc10, 0x0, 0xffe),
at 0xee073a8c
  [41] Run__17nsAppShellService(0x98300, 0xeecbcc88, 0x98300, 0xeda57b80, 0x0,
0xef12a148), at 0xeecbcc9c
  [42] 0x149a4(0x1, 0xefffe4dc, 0x1, 0x2, 0xffffffff, 0xef7c16e1), at 0x149a3
  [43] main(0x1, 0xefffe4dc, 0xefffe4e4, 0x29038, 0x0, 0x0), at 0x14ca8
(dbx) quit

Comment 1

[Peter Trudelle]

reassigning to sdagley as p2 for m13

Comment 2

[Steve Dagley]

So who in QA is running a Solaris system so I can look at this problem?

Comment 3

[Chris McAfee]

This crashes on Solaris:

#0  0x0 in ?? ()
#1  0xed54019c in nsDocShell::Release (this=0x1c62e0) at nsDocShell.cpp:109
#2  0xee504d20 in nsCOMPtr<nsIScriptGlobalObjectOwner>::~nsCOMPtr (
    this=0xefffd058, __in_chrg=2) at ../../../dist/include/nsCOMPtr.h:433
#3  0xee4fe180 in NS_ScriptErrorReporter (cx=0x27a198,
    message=0x1c50b0 "out of memory", report=0xefffd168)
    at nsJSEnvironment.cpp:104
#4  0xef6288d8 in js_ReportErrorAgain (cx=0x27a198,
    message=0x2faa50 "out of memory", reportp=0xefffd168) at jscntxt.c:520
#5  0xef627d70 in js_ReportErrorVA (cx=0x27a198, flags=0,
    format=0xef6b2770 "out of memory", ap=0xefffd26c) at jscntxt.c:264
#6  0xef61f564 in JS_ReportError (cx=0x27a198,
    format=0xef6b2770 "out of memory") at jsapi.c:2935
#7  0xef61f69c in JS_ReportOutOfMemory (cx=0x27a198) at jsapi.c:2978
#8  0xed955394 in XPCJSThrower::BuildAndThrowException (this=0x21bb80,
    cx=0x27a198, rv=2152923135,
    sz=0x5541f0 "Component returned failure code: 0x8052ffff
[nsIFileSpecWithUI.chooseFile]") at xpcthrower.cpp:213

Linux does not crash, but gives similar out of memory JS error

Comment 4

[Steve Dagley]

Thanks to mcafee and pavlov we have a fix for this bug and pav will check it when
the tree opens on 2000-01-07.  Marking bug as fixed although it won't show up in
today's build.  We also don't seem to have anyone in internal QA running Mozilla
under Solaris so verification will have to be external (or someone can go look at
a build on mcafee's Solaris boc)

Comment 5

[Claudius Gayle]

mcafee, can you verify this fix? Please, please please?

Comment 6

[Claudius Gayle]

Yay mcafee! VERIFIED fixed with 20000112 Solaris build.