22344 - nsDOMAttributeMap::RemoveNamedItem() freeing mismatched memory (FMM)

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[kinmoz]

I'm seeing a "freeing mismatched memory" error in
nsDOMAttributeMap::RemoveNamedItem() because we are freeing the hash table key
with delete. The hash table keys are actually allocated in nsStr.ToNewCString()
with PR_Malloc().

To reproduce this problem:

1. Launch Composer via the browser's Task->Composer menu.
2. Press the insert H.Line (HRule) button on the composer toolbar.
3. Now click on the HRule that was inserted so that it is hilited with a blue
box around it.
4. Now press the insert H.Line button on the composer toolbar again. This should
bring up the HRule dialog.
5. Now click on the okay button.

As the dialog closes, it triggers some editor JavaScript that calls into
RemoveNamedItem() and triggers the FMM. Here's the stack trace:




[E] FMM: Freeing mismatched memory in delete(void *) {4 occurrences}
        Address 0x0945e6d0 points into a HeapAlloc'd block in heap 0x03c30000
        Location of free attempt
            delete(void *) [dbgdel.cpp:35]
            nsDOMAttributeMap::RemoveNamedItem(nsString const&,nsIDOMNode * *)
[nsDOMAttributeMap.cpp:407]
            nsGenericElement::RemoveAttributeNode(nsIDOMAttr *,nsIDOMAttr * *)
[nsGenericElement.cpp:517]
            nsHTMLHRElement::RemoveAttributeNode(nsIDOMAttr *,nsIDOMAttr * *)
[nsHTMLHRElement.cpp:53]
            nsEditor::CloneAttributes(nsIDOMNode *,nsIDOMNode *)
[nsEditor.cpp:1654]
            nsEditorShell::CloneAttributes(nsIDOMNode *,nsIDOMNode *)
[nsEditorShell.cpp:1791]
            XPTC_InvokeByIndex [xptcinvoke.cpp:137]
            nsXPCWrappedNativeClass::CallWrappedMethod(JSContext
*,nsXPCWrappedNative *,XPCNativeMemberDescriptor
const*,CallMode::nsXPCWrappedNativeClass,UINT,long *,long *)
[xpcwrappednativeclass.cpp:904]
            WrappedNative_CallMethod(JSContext *,JSObject *,UINT,long *,long *)
[xpcwrappednativejsops.cpp:191]
            js_Invoke      [jsinterp.c:665]
        Allocation location
            No call stack recorded




Here's the stack trace to where the key is allocated:




PR_Malloc(unsigned int 65) line 34
nsAllocatorImpl::Alloc(nsAllocatorImpl * const 0x01015740, unsigned int 65) line
82 + 9 bytes
nsAllocator::Alloc(unsigned int 65) line 149
nsStr::Alloc(nsStr & {...}, unsigned int 5) line 665 + 9 bytes
nsStr::Realloc(nsStr & {...}, unsigned int 5) line 692 + 13 bytes
nsStr::EnsureCapacity(nsStr & {...}, unsigned int 5) line 101 + 13 bytes
nsStr::GrowCapacity(nsStr & {...}, unsigned int 5) line 121 + 13 bytes
nsStr::Append(nsStr & {...}, const nsStr & {...}, unsigned int 0, int 5) line
167 + 18 bytes
nsStr::Assign(nsStr & {...}, const nsStr & {...}, unsigned int 0, int 5) line
147 + 21 bytes
nsCString::nsCString(const nsStr & {...}) line 100 + 45 bytes
nsString::ToNewCString() line 644
nsDOMAttributeMap::GetNamedItemCommon(const nsString & {...}, int 0, nsIAtom *
0x016ef9f0, nsIDOMNode * * 0x0012b260) line 197 + 9 bytes
nsDOMAttributeMap::Item(nsDOMAttributeMap * const 0x02b96cb0, unsigned int 0,
nsIDOMNode * * 0x0012b260) line 450 + 27 bytes
nsEditor::CloneAttributes(nsEditor * const 0x02a15bc0, nsIDOMNode * 0x02977a60,
nsIDOMNode * 0x02baca50) line 1648 + 44 bytes
nsEditorShell::CloneAttributes(nsEditorShell * const 0x029dea10, nsIDOMNode *
0x02977a60, nsIDOMNode * 0x02baca50) line 1791 + 34 bytes
XPTC_InvokeByIndex(nsISupports * 0x029dea10, unsigned int 98, unsigned int 2,
nsXPTCVariant * 0x0012b4cc) line 139
nsXPCWrappedNativeClass::CallWrappedMethod(JSContext * 0x029fe340,
nsXPCWrappedNative * 0x029df4d0, const XPCNativeMemberDescriptor * 0x02749e34,
nsXPCWrappedNativeClass::CallMode CALL_METHOD, unsigned int 2, long *
0x02742f48, long * 0x0012b684) line 904 + 43 bytes
WrappedNative_CallMethod(JSContext * 0x029fe340, JSObject * 0x02782b70, unsigned
int 2, long * 0x02742f48, long * 0x0012b684) line 191 + 34 bytes
js_Invoke(JSContext * 0x029fe340, unsigned int 2, unsigned int 0) line 665 + 26
bytes
js_Interpret(JSContext * 0x029fe340, long * 0x0012bef4) line 2226 + 15 bytes
js_Invoke(JSContext * 0x029fe340, unsigned int 0, unsigned int 0) line 681 + 13
bytes
js_Interpret(JSContext * 0x029fe340, long * 0x0012c720) line 2226 + 15 bytes
js_Invoke(JSContext * 0x029fe340, unsigned int 0, unsigned int 0) line 681 + 13
bytes
js_Interpret(JSContext * 0x029fe340, long * 0x0012cf4c) line 2226 + 15 bytes
js_Invoke(JSContext * 0x029fe340, unsigned int 1, unsigned int 2) line 681 + 13
bytes
js_InternalCall(JSContext * 0x029fe340, JSObject * 0x027592a8, long 41259712,
unsigned int 1, long * 0x0012d0d0, long * 0x0012d07c) line 758 + 15 bytes
JS_CallFunctionValue(JSContext * 0x029fe340, JSObject * 0x027592a8, long
41259712, unsigned int 1, long * 0x0012d0d0, long * 0x0012d07c) line 2752 + 29
bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x029ffc20, void * 0x027592a8,
void * 0x027592c0, unsigned int 1, void * 0x0012d0d0, int * 0x0012d0cc) line 560
+ 33 bytes
nsJSEventListener::HandleEvent(nsIDOMEvent * 0x02c06824) line 128 + 57 bytes
nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x02b63f30,
nsIDOMEvent * 0x02c06824, unsigned int 4) line 651 + 19 bytes
nsEventListenerManager::HandleEvent(nsIPresContext * 0x02b33bb0, nsEvent *
0x0012d5c4, nsIDOMEvent * * 0x0012d58c, unsigned int 7, nsEventStatus *
0x0012d840) line 791 + 25 bytes
nsXULElement::HandleDOMEvent(nsXULElement * const 0x02b62070, nsIPresContext *
0x02b33bb0, nsEvent * 0x0012d5c4, nsIDOMEvent * * 0x0012d58c, unsigned int 1,
nsEventStatus * 0x0012d840) line 2676
nsEventStateManager::CheckForAndDispatchClick(nsEventStateManager * const
0x02b86930, nsIPresContext * 0x02b33bb0, nsMouseEvent * 0x0012d934,
nsEventStatus * 0x0012d840) line 1358 + 42 bytes
nsEventStateManager::PostHandleEvent(nsEventStateManager * const 0x02b86930,
nsIPresContext * 0x02b33bb0, nsGUIEvent * 0x0012d934, nsIFrame * 0x0274ad50,
nsEventStatus * 0x0012d840, nsIView * 0x02b33700) line 551 + 24 bytes
PresShell::HandleEvent(PresShell * const 0x02b33184, nsIView * 0x02b33700,
nsGUIEvent * 0x0012d934, nsEventStatus * 0x0012d840) line 2657 + 43 bytes
nsView::HandleEvent(nsView * const 0x02b33700, nsGUIEvent * 0x0012d934, unsigned
int 28, nsEventStatus * 0x0012d840, int & 0) line 841
nsViewManager::DispatchEvent(nsViewManager * const 0x02b33920, nsGUIEvent *
0x0012d934, nsEventStatus * 0x0012d840) line 1678
HandleEvent(nsGUIEvent * 0x0012d934) line 69
nsWindow::DispatchEvent(nsWindow * const 0x02b335d4, nsGUIEvent * 0x0012d934,
nsEventStatus & nsEventStatus_eIgnore) line 421 + 10 bytes
nsWindow::DispatchWindowEvent(nsGUIEvent * 0x0012d934) line 442
nsWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line 3332 +
21 bytes
ChildWindow::DispatchMouseEvent(unsigned int 301, nsPoint * 0x00000000) line
3550
nsWindow::ProcessMessage(unsigned int 514, unsigned int 0, long 14876753, long *
0x0012db94) line 2632 + 24 bytes
nsWindow::WindowProc(HWND__ * 0x07820490, unsigned int 514, unsigned int 0, long
14876753) line 608 + 27 bytes
USER

Comment 1

[vidur (gone)]

Index: nsDOMAttributeMap.cpp
===================================================================
RCS file: /cvsroot/mozilla/layout/base/src/nsDOMAttributeMap.cpp,v
retrieving revision 1.8
diff -r1.8 nsDOMAttributeMap.cpp
407c407
<           delete [] key;
---
>           Recycle(key);

Comment 2

[kinmoz]

Your patch seems to fix the FMM in the HRule dialog, but there are other cases
in the same file that get triggered when you bring up the insert table dialog. I
had to replace all delete calls in nsDOMAttributeMap.cpp to Recycle() to get rid
of them.

Here's the patch:

Index: nsDOMAttributeMap.cpp
===================================================================
RCS file:
/cvsroot/mozilla/layout/base/src/nsDOMAttributeMap.cpp,v
retrieving revision 1.8
diff -r1.8 nsDOMAttributeMap.cpp
60c60
<   delete [] str;
---
>   Recycle(str);
310c310
<             delete [] key;
---
>             Recycle(key);
407c407
<
        delete [] key;
---
>           Recycle(key);

Comment 3

[vidur (gone)]

Thanks - I was being sloppy. Fix checked in on 12/22/1999.

Comment 4

[sujay]

sure Gerardo, give this one to me....

Comment 5

[Jan Carpenter]

Mass update of qa contact

Comment 6

[Prashant Desale]

QA contact Update

Comment 7

[Prashant Desale]

Updating QA contact to Shivakiran Tummala.

Comment 8

[Sivakiran Tummala]

i do not know how to verify this . can some one verify this for me ..thanks

Comment 9

[Sivakiran Tummala]

Fix checked in on 12/22/1999 per comment # 3, marking verified