Closed Bug 210405 Opened 23 years ago Closed 14 years ago

Pasting crashed [@ LookupUCProperty] obj = 0

Categories

(Core :: DOM: Events, defect)

Product:
Core
Component:
DOM: Events
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: timeless, Assigned: dbradley)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

check obj
650 bytes, patch
Details | Diff | Splinter Review
LookupUCProperty(JSContext * 0x004c78d0, JSObject * 0x00000000, const unsigned short * 0x0012d374, unsigned int 15, JSObject * * 0x0012d240, JSProperty * * 0x0012d238) line 2289 + 23 bytes JS_LookupUCProperty(JSContext * 0x004c78d0, JSObject * 0x00000000, const unsigned short * 0x0012d374, unsigned int 15, long * 0x0012d344) line 2540 + 29 bytes nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02c14cb0, nsIDOMEvent * 0x04cc4ba8) line 137 + 53 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x02c14ee0, nsIDOMEvent * 0x04cc4ba8, nsIDOMEventTarget * 0x04cc4b20, unsigned int 32, unsigned int 7) line 1191 + 20 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02c14d00, nsIPresContext * 0x0251a9a0, nsEvent * 0x0012de38, nsIDOMEvent * * 0x0012ddac, nsIDOMEventTarget * 0x04cc4b20, unsigned int 7, nsEventStatus * 0x0012de60) line 2190 + 36 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02bd30d0, nsIPresContext * 0x0251a9a0, nsEvent * 0x0012de38, nsIDOMEvent * * 0x0012ddac, unsigned int 7, nsEventStatus * 0x0012de60) line 3303 nsXULCommandDispatcher::UpdateCommands(nsXULCommandDispatcher * const 0x024f3f20, const nsAString & {...}) line 390 GlobalWindowImpl::UpdateCommands(GlobalWindowImpl * const 0x004c7c94, const nsAString & {...}) line 3501 nsTextInputListener::UpdateTextInputCommands(const nsAString & {...}) line 399 + 30 bytes nsTextInputListener::NotifySelectionChanged(nsTextInputListener * const 0x03278110, nsIDOMDocument * 0x024f27f4, nsISelection * 0x03278530, short 0) line 293 + 25 bytes nsTypedSelection::NotifySelectionListeners() line 7839 nsSelection::NotifySelectionListeners(short 1) line 3310 + 16 bytes nsSelection::EndBatchChanges(nsSelection * const 0x032785b0) line 3300 nsTypedSelection::EndBatchChanges(nsTypedSelection * const 0x03278534) line 7859 nsEditor::EndUpdateViewBatch() line 4482 nsEditor::EndPlaceHolderTransaction(nsEditor * const 0x03278750) line 785 nsAutoPlaceHolderBatch::~nsAutoPlaceHolderBatch() line 67 + 47 bytes nsAutoEditBatch::~nsAutoEditBatch() line 79 + 15 bytes nsPlaintextEditor::InsertTextFromTransferable(nsPlaintextEditor * const 0x03278750, nsITransferable * 0x04cc4d60, nsIDOMNode * 0x00000000, int 0, int 1) line 138 + 11 bytes nsPlaintextEditor::Paste(nsPlaintextEditor * const 0x03278750, int 1) line 444 + 30 bytes nsPasteCommand::DoCommand(nsPasteCommand * const 0x0327ac60, const char * 0x0012e810, nsISupports * 0x03278750) line 414 + 28 bytes nsControllerCommandTable::DoCommand(nsControllerCommandTable * const 0x03279610, const char * 0x0012e810, nsISupports * 0x03278750) line 191 + 31 bytes nsBaseCommandController::DoCommand(nsBaseCommandController * const 0x032796c0, const char * 0x0012e810) line 133 nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver * 0x0326a4e0, nsIDOMEvent * 0x04cc73d8) line 320 nsXBLEventHandler::DoKey(nsIAtom * 0x0038c788 {???}, nsIDOMEvent * 0x04cc73d8) line 129 nsXBLKeyHandler::KeyPress(nsXBLKeyHandler * const 0x0326a130, nsIDOMEvent * 0x04cc73d8) line 90 nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x031f5af0, nsIPresContext * 0x0251a9a0, nsEvent * 0x0012f774, nsIDOMEvent * * 0x0012f074, nsIDOMEventTarget * 0x04cc5df0, unsigned int 519, nsEventStatus * 0x0012f5f4) line 1631 + 41 bytes nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x031f3550, nsIPresContext * 0x0251a9a0, nsEvent * 0x0012f774, nsIDOMEvent * * 0x0012f074, unsigned int 519, nsEventStatus * 0x0012f5f4) line 1921 nsHTMLInputElement::HandleDOMEvent(nsHTMLInputElement * const 0x031f3550, nsIPresContext * 0x0251a9a0, nsEvent * 0x0012f774, nsIDOMEvent * * 0x00000000, unsigned int 513, nsEventStatus * 0x0012f5f4) line 1442 + 29 bytes PresShell::HandleEventInternal(nsEvent * 0x0012f774, nsIView * 0x0251bf90, unsigned int 1, nsEventStatus * 0x0012f5f4) line 6383 + 55 bytes PresShell::HandleEvent(PresShell * const 0x0251b7c4, nsIView * 0x0251bf90, nsGUIEvent * 0x0012f774, nsEventStatus * 0x0012f5f4, int 1, int & 1) line 6257 + 25 bytes nsViewManager::HandleEvent(nsView * 0x0251bf90, nsGUIEvent * 0x0012f774, int 0) line 2270 nsView::HandleEvent(nsViewManager * 0x0251a180, nsGUIEvent * 0x0012f774, int 0) line 308 nsViewManager::DispatchEvent(nsViewManager * const 0x0251a180, nsGUIEvent * 0x0012f774, nsEventStatus * 0x0012f734) line 2046 + 23 bytes HandleEvent(nsGUIEvent * 0x0012f774) line 82 nsWindow::DispatchEvent(nsWindow * const 0x0251bea4, nsGUIEvent * 0x0012f774, nsEventStatus & nsEventStatus_eIgnore) line 1054 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f774) line 1075 nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 118, unsigned int 0, long 0) line 2915 + 15 bytes nsWindow::OnChar(unsigned int 22, unsigned int 0, unsigned char 0) line 3102 nsWindow::ProcessMessage(unsigned int 258, unsigned int 22, long 3080193, long * 0x0012fbe0) line 3813 + 38 bytes nsWindow::WindowProc(HWND__ * 0x01c20570, unsigned int 258, unsigned int 22, long 3080193) line 1337 + 27 bytes NS_IMETHODIMP XPCWrappedNative::GetJSObject(JSObject * *aJSObject) { *aJSObject = mFlatJSObject; return NS_OK; } Note that it always returns OK even for null out. Some impls will ASSERT non null out, but most will return OK + null. Frame that caused cascade: nsJSEventListener::HandleEvent(nsJSEventListener * const 0x02c14cb0, nsIDOMEvent * 0x04cc4ba8) line 137 + 53 bytes Code: rv = wrapper->GetJSObject(&obj); NS_ENSURE_SUCCESS(rv, rv); if (!JS_LookupUCProperty(cx, obj, NS_REINTERPRET_CAST(const jschar *, eventString.get()), eventString.Length(), &funval)) { jst: you own blame for the NS_ENSURE, so this bug is for you :) Problematic local variable: - wrapper {0x034775f0} \- nsCOMPtr_base {...} \- mRawPtr 0x034775f0 |- [XPCWrappedNative] {...} ||+ nsIXPConnectWrappedNative {...} ||+ mRefCnt {2} ||+ mMaybeScope 0x02dd0b80 ||+ mMaybeProto 0x02dd0b80 ||+ mSet 0x024dd670 ||+ mIdentity 0x02bd30d0 ||+ mFlatJSObject 0x00000000 ||- mScriptableInfo 0x02dd0b40 ||\- mCallback {0x024d0ab0} || \- nsCOMPtr_base {...} || \- mRawPtr 0x024d0ab0 || \+ __vfptr 0x01f119c0 const nsElementSH::`vftable'{for `nsIXPCScriptable'} ||- mShared 0x024dd5f0 |||+ mFlags {...} ||\- mJSClass {...} || |+ name 0x024db230 "XULElement" || | flags 13 || | ... || | call 0x00000000 || | construct 0x00000000 || | xdrObject 0x00000000 || | hasInstance 0x00000000 || | mark 0x012e81e0 XPC_WN_Shared_Mark(JSContext *, JSObject *, void *) || \ spare 0 |\+ mFirstChunk {...} + __vfptr 0x012f4740 const XPCWrappedNative::`vftable'
The only way this obj should be null is if the system is shutting down, the object is being finalized, or possible if it wasn't completely initialized. From your dump of the wrapped native and the stack, it doesn't look like it was shutting down and pretty sure it wasn't being finalized given there's no GC reference on the stack and this is the main thread. If you can reproduce on a clean CVS build then I'd say lets spend some time investigating. There's just no obvious way that the wrapped native and it's tearoff could have gotten into this state..
Attached patch check obj — — Splinter Review
Was talking to timeless after he added some checks. The object has been finalized, so there must be some kind of race condition in GC. If someone held the wrapper, the object shouldn't have been finalized. I suspect his system was operating slowly and triggered the situation. I'll take this for now and see how this could have occured.
Assignee: jst → dbradley
LookupUCProperty(JSContext * 0x021303f0, JSObject * 0xfffffffd, const unsigned short * 0x001297f4, unsigned int 15, JSObject * * 0x001296c0, JSProperty * * 0x001296b8) line 2332 + 33 bytes JS_LookupUCProperty(JSContext * 0x021303f0, JSObject * 0xfffffffd, const unsigned short * 0x001297f4, unsigned int 15, long * 0x001297c4) line 2583 + 29 bytes nsJSEventListener::HandleEvent(nsJSEventListener * const 0x0388d9c0, nsIDOMEvent * 0x01830b34) line 136 + 53 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x0388e880, nsIDOMEvent * 0x01830b34, nsIDOMEventTarget * 0x0551d288, unsigned int 32, unsigned int 7) line 1422 + 20 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x0388e818, nsIPresContext * 0x021d9d78, nsEvent * 0x00129f10, nsIDOMEvent * * 0x00129e44, nsIDOMEventTarget * 0x0551d288, unsigned int 7, nsEventStatus * 0x00129f38) line 1515 + 56 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02af7e08, nsIPresContext * 0x021d9d78, nsEvent * 0x00129f10, nsIDOMEvent * * 0x00129e44, unsigned int 7, nsEventStatus * 0x00129f38) line 3168 nsXULCommandDispatcher::UpdateCommands(nsXULCommandDispatcher * const 0x029c50e0, const nsAString & {...}) line 382 GlobalWindowImpl::UpdateCommands(GlobalWindowImpl * const 0x0216c7cc, const nsAString & {...}) line 3527 nsFocusController::UpdateCommands(nsFocusController * const 0x02a32168, const nsAString & {...}) line 168 nsFocusController::Focus(nsFocusController * const 0x02a3216c, nsIDOMEvent * 0x04e71388) line 318 + 33 bytes DispatchToInterface(nsIDOMEvent * 0x04e71388, nsIDOMEventListener * 0x02a3216c, unsigned int (nsIDOMEvent *)* 0x013be3a0 `vcall'(nsIDOMEvent *), const nsID & {...}, int * 0x0012a1a0) line 128 + 11 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x02205398, nsIPresContext * 0x021d9d78, nsEvent * 0x0012a5f8, nsIDOMEvent * * 0x0012a30c, nsIDOMEventTarget * 0x029cc160, unsigned int 4, nsEventStatus * 0x0012a5f4) line 1508 + 35 bytes nsWindowRoot::HandleChromeEvent(nsWindowRoot * const 0x029cc168, nsIPresContext * 0x021d9d78, nsEvent * 0x0012a5f8, nsIDOMEvent * * 0x0012a30c, unsigned int 4, nsEventStatus * 0x0012a5f4) line 214 GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x0216c7c8, nsIPresContext * 0x021d9d78, nsEvent * 0x0012a5f8, nsIDOMEvent * * 0x0012a30c, unsigned int 7, nsEventStatus * 0x0012a5f4) line 842 nsEventStateManager::PreHandleEvent(nsEventStateManager * const 0x02c51a18, nsIPresContext * 0x021d9d78, nsEvent * 0x0012a974, nsIFrame * 0x038f2dc4, nsEventStatus * 0x0012a7a0, nsIView * 0x0220afb0) line 541 PresShell::HandleEventInternal(nsEvent * 0x0012a974, nsIView * 0x0220afb0, unsigned int 1, nsEventStatus * 0x0012a7a0) line 6178 + 49 bytes PresShell::HandleEvent(PresShell * const 0x02a0dcd8, nsIView * 0x0220afb0, nsGUIEvent * 0x0012a974, nsEventStatus * 0x0012a7a0, int 1, int & 1) line 6079 + 25 bytes nsViewManager::HandleEvent(nsView * 0x0220afb0, nsGUIEvent * 0x0012a974, int 0) line 2255 nsView::HandleEvent(nsViewManager * 0x0220add0, nsGUIEvent * 0x0012a974, int 0) line 298 nsViewManager::DispatchEvent(nsViewManager * const 0x0220add0, nsGUIEvent * 0x0012a974, nsEventStatus * 0x0012a8e4) line 2038 + 23 bytes HandleEvent(nsGUIEvent * 0x0012a974) line 79 nsWindow::DispatchEvent(nsWindow * const 0x0220b05c, nsGUIEvent * 0x0012a974, nsEventStatus & nsEventStatus_eIgnore) line 1049 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012a974) line 1070 nsWindow::DispatchFocus(unsigned int 105, int 1) line 5385 + 15 bytes nsWindow::ProcessMessage(unsigned int 7, unsigned int 459650, long 0, long * 0x0012ad94) line 4129 + 23 bytes nsWindow::WindowProc(HWND__ * 0x00040400, unsigned int 7, unsigned int 459650, long 0) line 1332 + 27 bytes USER32! SetTimer + 1077 bytes USER32! GetMonitorInfoW + 156 bytes USER32! GetMonitorInfoW + 222 bytes NTDLL! KiUserCallbackDispatcher + 19 bytes nsEventStateManager::SendFocusBlur(nsIPresContext * 0x021d9d78, nsIContent * 0x03b18618, int 1) line 4241 nsEventStateManager::SetContentState(nsEventStateManager * const 0x02c51a18, nsIContent * 0x03b18618, int 2) line 3945 nsXULElement::SetFocus(nsXULElement * const 0x03b18618, nsIPresContext * 0x021d9d78) line 4223 nsXULElement::Focus(nsXULElement * const 0x03b1861c) line 4112 + 28 bytes XPTC_InvokeByIndex(nsISupports * 0x03b1861c, unsigned int 108, unsigned int 0, nsXPTCVariant * 0x0012b460) line 102 XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode CALL_METHOD) line 2023 + 42 bytes XPC_WN_CallMethod(JSContext * 0x021303f0, JSObject * 0x03a8f5b0, unsigned int 0, long * 0x055aa0b0, long * 0x0012b718) line 1269 + 14 bytes js_Invoke(JSContext * 0x021303f0, unsigned int 0, unsigned int 0) line 912 + 23 bytes js_Interpret(JSContext * 0x021303f0, long * 0x0012c04c) line 2933 + 15 bytes js_Invoke(JSContext * 0x021303f0, unsigned int 1, unsigned int 2) line 929 + 13 bytes nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJSClass * const 0x02b5c7b0, nsXPCWrappedJS * 0x03b55978, unsigned short 3, const nsXPTMethodInfo * 0x0203f8e0, nsXPTCMiniVariant * 0x0012c3dc) line 1331 + 22 bytes nsXPCWrappedJS::CallMethod(nsXPCWrappedJS * const 0x03b55978, unsigned short 3, const nsXPTMethodInfo * 0x0203f8e0, nsXPTCMiniVariant * 0x0012c3dc) line 429 PrepareAndDispatch(nsXPTCStubBase * 0x03b55978, unsigned int 3, unsigned int * 0x0012c48c, unsigned int * 0x0012c47c) line 117 + 31 bytes SharedStub() line 147 nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x03b559f0, nsIDOMEvent * 0x04ededd0, nsIDOMEventTarget * 0x020625a8, unsigned int 4, unsigned int 2) line 1422 + 20 bytes nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x029c9280, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, nsIDOMEventTarget * 0x020625a8, unsigned int 2, nsEventStatus * 0x0012f5f0) line 1515 + 56 bytes nsXULDocument::HandleDOMEvent(nsXULDocument * const 0x02062510, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 1267 nsXULElement::HandleDOMEvent(nsXULElement * const 0x02ab7f60, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3191 + 47 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02c01500, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3185 + 61 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02bfadf8, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3185 + 61 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02b268f8, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3185 + 61 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02bfce70, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3185 + 61 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x03b3ba70, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3185 + 61 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x03b18690, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3185 + 61 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x04710170, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3185 + 61 bytes nsXULElement::HandleChromeEvent(nsXULElement * const 0x0471017c, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 4304 + 39 bytes GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x03f31e48, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 868 nsDocument::HandleDOMEvent(nsDocument * const 0x046bfc68, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 3566 nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x03ee5260, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 2037 + 47 bytes nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x03fb76a8, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 2030 + 60 bytes nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x03fe1df8, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 2, nsEventStatus * 0x0012f5f0) line 2030 + 60 bytes nsGenericElement::HandleDOMEvent(nsGenericElement * const 0x0470ef48, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x0012f1e0, unsigned int 7, nsEventStatus * 0x0012f5f0) line 2030 + 60 bytes nsGenericHTMLElement::HandleDOMEventForAnchors(nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus * 0x0012f5f0) line 1405 + 32 bytes nsHTMLAnchorElement::HandleDOMEvent(nsHTMLAnchorElement * const 0x0470ef48, nsIPresContext * 0x047ca1b0, nsEvent * 0x0012f7c4, nsIDOMEvent * * 0x00000000, unsigned int 1, nsEventStatus * 0x0012f5f0) line 352 PresShell::HandleEventInternal(nsEvent * 0x0012f7c4, nsIView * 0x03e2a5f8, unsigned int 1, nsEventStatus * 0x0012f5f0) line 6192 + 47 bytes PresShell::HandleEvent(PresShell * const 0x03d96010, nsIView * 0x03e2a5f8, nsGUIEvent * 0x0012f7c4, nsEventStatus * 0x0012f5f0, int 1, int & 1) line 6079 + 25 bytes nsViewManager::HandleEvent(nsView * 0x03e2a5f8, nsGUIEvent * 0x0012f7c4, int 0) line 2255 nsView::HandleEvent(nsViewManager * 0x03e2a418, nsGUIEvent * 0x0012f7c4, int 0) line 298 nsViewManager::DispatchEvent(nsViewManager * const 0x03e2a418, nsGUIEvent * 0x0012f7c4, nsEventStatus * 0x0012f734) line 2038 + 23 bytes HandleEvent(nsGUIEvent * 0x0012f7c4) line 79 nsWindow::DispatchEvent(nsWindow * const 0x03e2a6a4, nsGUIEvent * 0x0012f7c4, nsEventStatus & nsEventStatus_eIgnore) line 1049 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012f7c4) line 1070 nsWindow::DispatchKeyEvent(unsigned int 131, unsigned short 0, unsigned int 33, long 21561345) line 2916 + 15 bytes nsWindow::OnKeyDown(unsigned int 33, unsigned int 329, long 21561345) line 3006 nsWindow::ProcessMessage(unsigned int 256, unsigned int 33, long 21561345, long * 0x0012fc34) line 3905 + 36 bytes nsWindow::WindowProc(HWND__ * 0x00070382, unsigned int 256, unsigned int 33, long 21561345) line 1332 + 27 bytes USER32! SetTimer + 1077 bytes USER32! DispatchMessageW + 278 bytes USER32! DispatchMessageW + 11 bytes nsAppShellService::Run(nsAppShellService * const 0x00c5d738) line 476 Index: xpcprivate.h =================================================================== RCS file: /cvsroot/mozilla/js/src/xpconnect/src/xpcprivate.h,v retrieving revision 1.138 diff -u -r1.138 xpcprivate.h --- xpcprivate.h +++ xpcprivate.h @@ -1741,7 +1744,12 @@ NS_DECL_NSIXPCONNECTWRAPPEDNATIVE JSBool - IsValid() const {return nsnull != mFlatJSObject;} + IsValid() const { + // XXX dbradley made me do it + return + mFlatJSObject < (JSObject*)-5 && + mFlatJSObject > nsnull; + } #define XPC_SCOPE_TAG ((jsword)0x1) #define XPC_SCOPE_WORD(s) ((jsword)(s)) Index: xpcwrappednative.cpp =================================================================== RCS file: /cvsroot/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,v retrieving revision 1.80 diff -u -r1.80 xpcwrappednative.cpp --- xpcwrappednative.cpp +++ xpcwrappednative.cpp @@ -891,7 +895,8 @@ } //This makes IsValid return false from now on... - mFlatJSObject = nsnull; + // XXX dbradley made me do it + mFlatJSObject = (JSObject*)-3; NS_ASSERTION(mIdentity, "bad pointer!"); #ifdef XP_WIN I believe this is profile 'two' (i think profile 'n7' is busy playing games w/ venkman+jsd). i'll try to leave the stack alive for a while.
QA Contact: desale → events
Crash Signature: [@ LookupUCProperty]
This bug has no information on current versions and no clear lead as to what the crashes that it tracks are. This should either be updated with current info and reopened or new bugs be filed on concrete actions/crashes on current code.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: