Closed Bug 21608 Opened 26 years ago Closed 26 years ago

Crash: RDF derefs bad pointer

Categories

(Core Graveyard :: RDF, defect, P1)

Product:
Core Graveyard
Component:
RDF
Platform:
x86
Windows NT
Type:
defect

Tracking

(Not tracked)

Status:
CLOSED WORKSFORME

People

(Reporter: selmer, Assigned: waterson)

Details

Manage Bookmarks. Select several bookmarks with shift+click. Edit | Delete them. Crash. Here is the stack trace. Note that this is not an assertion. The assertion routine at the top of the stack dereferenced a bad pointer called mNextAssertion whose pointer had the value 0x61. nMemoryAssertionEnumeratorImpl::HasMoreElements(InMemoryAssertionEnumeratorImpl * const 0x02495d10, int * 0x0012dd38) line 359 + 12 bytes RDFContainerImpl::Renumber(int 23, int -1) line 581 + 27 bytes RDFContainerImpl::RemoveElement(RDFContainerImpl * const 0x024adbc0, nsIRDFNode * 0x01d96e50, int 1) line 269 + 17 bytes XPTC_InvokeByIndex(nsISupports * 0x024adbc0, unsigned int 9, unsigned int 2, nsXPTCVariant * 0x0012df24) line 139 nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x022e7140, nsXPCWrappedNative * 0x024ae7e0, const XPCNativeMemberDescriptor * 0x024aeb2c, nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 2, long * 0x01e25da8, long * 0x0012e0d4) line 894 + 43 bytes WrappedNative_CallMethod(JSContext * 0x022e7140, JSObject * 0x00d6c780, unsigned int 2, long * 0x01e25da8, long * 0x0012e0d4) line 191 + 34 bytes js_Invoke(JSContext * 0x022e7140, unsigned int 2, unsigned int 0) line 665 + 26 bytes js_Interpret(JSContext * 0x022e7140, long * 0x0012e944) line 2226 + 15 bytes js_Invoke(JSContext * 0x022e7140, unsigned int 1, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x022e7140, long * 0x0012f170) line 2226 + 15 bytes js_Invoke(JSContext * 0x022e7140, unsigned int 1, unsigned int 2) line 681 + 13 bytes js_InternalCall(JSContext * 0x022e7140, JSObject * 0x00d6c4c8, long 14075088, unsigned int 1, long * 0x0012f2f4, long * 0x0012f2a0) line 758 + 15 bytes JS_CallFunctionValue(JSContext * 0x022e7140, JSObject * 0x00d6c4c8, long 14075088, unsigned int 1, long * 0x0012f2f4, long * 0x0012f2a0) line 2752 + 29 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x022e7b00, void * 0x00d6c4c8, void * 0x00d6c4d0, unsigned int 1, void * 0x0012f2f4, int * 0x0012f2f0) line 547 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x02444074) line 128 + 57 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x02333d60, nsIDOMEvent * 0x02444074, unsigned int 8) line 651 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x0230e800, nsEvent * 0x0012f7dc, nsIDOMEvent * * 0x0012f7a8, unsigned int 7, nsEventStatus * 0x0012f820) line 1405 + 31 bytes nsXULElement::HandleDOMEvent(nsXULElement * const 0x02333e90, nsIPresContext * 0x0230e800, nsEvent * 0x0012f7dc, nsIDOMEvent * * 0x0012f7a8, unsigned int 1, nsEventStatus * 0x0012f820) line 2675 nsMenuFrame::Execute() line 1236 nsMenuFrame::HandleEvent(nsMenuFrame * const 0x01e28b38, nsIPresContext * 0x0230e800, nsGUIEvent * 0x0012fb68, nsEventStatus * 0x0012fa74) line 284 PresShell::HandleEvent(PresShell * const 0x0230fde4, nsIView * 0x0243fb50, nsGUIEvent * 0x0012fb68, nsEventStatus * 0x0012fa74) line 2572 + 38 bytes nsView::HandleEvent(nsView * const 0x0243fb50, nsGUIEvent * 0x0012fb68, unsigned int 8, nsEventStatus * 0x0012fa74, int & 0) line 841 nsView::HandleEvent(nsView * const 0x0230e480, nsGUIEvent * 0x0012fb68, unsigned int 28, nsEventStatus * 0x0012fa74, int & 0) line 826 nsViewManager::DispatchEvent(nsViewManager * const 0x0230e6a0, nsGUIEvent * 0x0012fb68, nsEventStatus * 0x0012fa74) line 1678 HandleEvent(nsGUIEvent * 0x0012fb68) line 69 nsWindow::DispatchEvent(nsWindow * const 0x0243fa24, nsGUIEvent * 0x0012fb68, nsEventStatus & nsEventStatus_eIgnore) line 421 + 10 bytes nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012fb68) line 442 nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3332 + 21 bytes ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3550 nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 7798825, long * 0x0012fdc8) line 2632 + 24 bytes nsWindow::WindowProc(HWND__ * 0x00090184, unsigned int 514, unsigned int 0, long 7798825) line 608 + 27 bytes USER32! 77e71820()
Status: NEW → ASSIGNED
Priority: P3 → P1
Target Milestone: M13
Zoiks!
Severity: normal → critical
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → WORKSFORME
selmer: I can't reproduce this. I -do- get an NS_ASSERTION() at a different place, attempting to index an element out-of-range in a DOM selection. rjc: have you done anything recently that might've fixed this?
Nope.
Status: RESOLVED → CLOSED
I can't reproduce this either. Closing this out. If you see it again please re-open it.
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.