239045 - XMLHttpRequest crashes browser if called again after refreshing the page

Status: RESOLVED WORKSFORME

(Core :: XML, defect)

Description

[sven.bott]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040328
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) Gecko/20040328

I call a javascript function from a XUL page to send the request. The
corresponding code in my javascript function is as follows:

//-------------------
netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
var cls_xml = Components.classes["@mozilla.org/xmlextras/xmlhttprequest;1"];
var request = cls_xml.getService(Components.interfaces.nsIXMLHttpRequest);
request.open('post','http://some.php');
request.setRequestHeader('content-type','xml/text');
request.send(SomeXMLString);
//-------------------

I can send the request as often as I want without any problem, but if I reload
the page and try to send again, Mozilla always crashes.

Reproducible: Always
Steps to Reproduce:
1. Send the request
2. Reload the page
3. Send the request again

Actual Results:  
Mozilla crashed and was ended.

Expected Results:  
It should have sent the request again.

Comment 1

[sven.bott]

Talkback Incident ID: TB31738514M

Comment 2

[sven.bott]

Attachment: The error stack of the crash

Comment 3

[Darin Fisher]

doron, jeff: can either of you confirm this crash report?

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

The crash mentioned here actually maps to a 1.4-based 2003-06-24-08 build:

Stack Signature  	nsXMLHttpRequest::GetLoadGroup 278b5f54
Email Address 	
Product ID 	Gecko1.4
Build ID 	2003062408
Trigger Time 	2004-03-29 01:58:50
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	xmlextras.dll
URL visited 	
User Comments 	
Trigger Reason 	Access violation
Source File Name 
d:/builds/seamonkey/mozilla/extensions/xmlextras/base/src/nsXMLHttpRequest.cpp
Trigger Line No. 	600
Stack Trace 	
nsXMLHttpRequest::GetLoadGroup
[d:/builds/seamonkey/mozilla/extensions/xmlextras/base/src/nsXMLHttpRequest.cpp,
line 600]
nsXMLHttpRequest::GetLoadGroup
[d:/builds/seamonkey/mozilla/extensions/xmlextras/base/src/nsXMLHttpRequest.cpp,
line 606]
NS_NewChannel [../../../../dist/include/necko\nsNetUtil.h, line 181]
invoke_copy_to_stack
[d:/builds/seamonkey/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp]
XPCWrappedNative::CallMethod
[d:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 1939]
XPC_WN_Helper_NewResolve
[d:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 902]
js_InternalGetOrSet [d:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 975]
js_Interpret [d:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2889]
js_Execute [d:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 996]
js_CheckRedeclaration [d:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 1228]
JS_CallFunctionName [d:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3514]
nsJSContext::InitContext
[d:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1227]
nsJSEventListener::HandleEvent
[d:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 194]
nsPrintEngine::ElipseLongString
[d:/builds/seamonkey/mozilla/content/base/src/nsPrintEngine.cpp, line 3468]
nsPrintEngine::PrintPage
[d:/builds/seamonkey/mozilla/content/base/src/nsPrintEngine.cpp, line 3568]
nsXULDocument::OverlayForwardReference::Merge
[d:/builds/seamonkey/mozilla/content/xul/document/src/nsXULDocument.cpp, line 3955]
PresShell::HandleEvent
[d:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6107]
nsMenuPopupFrame::FindMenuWithShortcut
[d:/builds/seamonkey/mozilla/layout/xul/base/src/nsMenuPopupFrame.cpp, line 1712]
nsMenuPopupFrame::Escape
[d:/builds/seamonkey/mozilla/layout/xul/base/src/nsMenuPopupFrame.cpp, line 1616]
PresShell::RetargetEventToParent
[d:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6074]
PresShell::PushCurrentEventInfo
[d:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5985]
nsDOMAttribute::CompareDocumentPosition
[d:/builds/seamonkey/mozilla/content/base/src/nsDOMAttribute.cpp, line 592]
nsScriptLoader::OnStreamComplete
[d:/builds/seamonkey/mozilla/content/base/src/nsScriptLoader.cpp, line 859]
PresShell::RetargetEventToParent
[d:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6081]
ComputeClipRect
[d:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 5832]
nsBindingManager::RemoveLayeredBinding
[d:/builds/seamonkey/mozilla/content/xbl/src/nsBindingManager.cpp, line 832]
nsXBLContentSink::ConstructResource
[d:/builds/seamonkey/mozilla/content/xbl/src/nsXBLContentSink.cpp, line 540]
DeleteInsertionPoint
[d:/builds/seamonkey/mozilla/content/xbl/src/nsBindingManager.cpp, line 129]
nsXBLContentSink::CreateElement
[d:/builds/seamonkey/mozilla/content/xbl/src/nsXBLContentSink.cpp, line 743]
nsWindow::BlurEventsSuppressed
[d:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1025]
nsWindow::DispatchEvent
[d:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1054]
nsWindow::DispatchMouseEvent
[d:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5187]
ChildWindow::DispatchMouseEvent
[d:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5432]
nsWindow::ProcessMessage
[d:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 4024]
nsWindow::WindowProc
[d:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1328]
USER32.dll + 0x3a5f (0x77d13a5f)
USER32.dll + 0x3b2e (0x77d13b2e)
USER32.dll + 0x3d6a (0x77d13d6a)
USER32.dll + 0x3dd0 (0x77d13dd0)
nsAppShellService::UnregisterTopLevelWindow
[d:/builds/seamonkey/mozilla/xpfe/appshell/src/nsAppShellService.cpp, line 979]
main1 [d:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1284]
main [d:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1650]
WinMain [d:/builds/seamonkey/mozilla/xpfe/bootstrap/nsAppRunner.cpp, line 1669]
mozilla.exe + 0x11778 (0x00411778)
kernel32.dll + 0x1eb69 (0x77e5eb69) 

Comment 5

[sven.bott]

I installed the nightly build from 2004-28-03 on my machine before reporting 
the bug as suggested in the bug reporting guidelines. Since then talkback 
doesn't come up anymore when the browser crashes. That's why I had to produce 
the error stack with an older build. The browser crashes identically with both 
builds, however, so that shouldn't be an issue.

Comment 6

[Doron Rosenberg (IBM)]

can you provide a working testcase?

Comment 7

[sven.bott]

I have installed a demonstration of the bug on http://www.trionic-
solutions.de/testcase

Comment 8

[Alfonso Martinez]

the file http://www.trionic-solutions.de/lib/request.js is missing

Comment 9

[sven.bott]

Alfonso, open the directory mozilla/defaults/prefs and edit the file all.js. 
Set the entry "signed.applets.codebase_principal_support" to true. Then restart 
Mozilla. When you click "send" the first time after the change you will be 
asked to grant the script execution privileges. Check "remember this decision" 
and click "yes". The demo should work now.

Comment 10

[Doron Rosenberg (IBM)]

I can reproduce this.

Reporter: how about doing var xmlHTTPRequest = new XMLHttpRequest() rather than
going the xpcom route?  Does that fix the issue?

Comment 11

[sven.bott]

Thanks a lot for the hint, that works :-)

Comment 12

[olecom]

Would you like to help me to get rid of problems like reentrance/locking of
functions ?
For example(latest case).
I make one global timer and one global XMLHttpRequest. Last is for synchronous
communication with server. Problem with this is:

...
updatetimerid = setInterval("spectrum_update()", refresh*1000);
/* refresh ~~ 1 */

...

function spectrum_update()
{
    try {
/*
            if (req_lock == 1) {
                add_log("(FIXME) make less update rate !!!");
                req_avr_test.abort();
                req_lock = 0;
                return
            }
        req_lock = 1;
*/
        req_avr_test.abort(); 
        req_avr_test.onerror=spectrum_update_error;
        req_avr_test.onload=spectrum_update_loaded;

        req_avr_test.open("GET", "./cgi-bin/client/diff.sh");
        req_avr_test.send("");
        add_log ("(CMD) Get differential spectro");
    } catch (exc) {
        add_log("(EXC) "+exc+" spectrum_update()");
    }

}

Crashed browser (1.6 based with):
###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().:
'mRawPtr != 0', file
../../../../dist/include/xpcom/nsCOMPtr.h, line 670
Break: at file ../../../../dist/include/xpcom/nsCOMPtr.h, line 670

Program ./mozilla-bin (pid = 4493) received signal 11.
Stack:
_ZN13nsProfileLock18FatalSignalHandlerEi+0x00000052
[/mnt/store/GNU+Linux/mozilla/mozf/mozilla/di
st/bin/components/libprofile.so +0x00030682]
Sleeping for 5 minutes.

But if I rewrite function above like:
...
    try {
            if (req_lock == 1) {
                add_log("(FIXME) make less update rate !!!");
                req_avr_test.abort();
                req_lock = 0;
                return
            }
        req_lock = 1;
/*
        req_avr_test.abort(); 
*/
        req_avr_test.onerror=spectrum_update_error;

...
where 

function spectrum_update_loaded()
{
   ... /* stuff even without this.* calls */
    req_lock = 0;
}

all works just fine.

Is there any methods to force mozilla do not recall or reenter functions/objects?
And thus generate less silent crashes.

Thanks.

Comment 13

[timeless]

[e-mail]: could you do:
./mozilla -g -d gdb
run

load your testcase.
when you die, use |where|.
attach or paste the stack output here.

Comment 14

[olecom]

Attachment: "XMLHttpRequest abort()" crash gdb output

Comment 15

[timeless]

The crash from the 1.6 branch is in code that has changed significantly. please 
try to crash using a debug build from trunk.

Comment 16

[olecom]

firefox-i686-linux-gtk2+xft.tar.gz           03-Jun-2004 10:40  7.8M
from
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/
is OK. yea, my fault do not check latest build.
Many fixes GTK2, CSS, speed. IMHO there's one little on screen but
big in source problem with Date object (lowlevel). Here it is:
if
var tDate = new Date();
then
String(tDate) == "Fri Jun 04 2004 01:55:51 GMT+0300 (EET)"
but
gluon:/mnt/work/BSU/DIPLOMA/hardware/spectro/pc_sp_drv$ LANG=C date
Fri Jun  4 02:02:14 EEST 2004
gluon:/mnt/work/BSU/DIPLOMA/hardware/spectro/pc_sp_drv$

Problem with "EET" != "EEST" is very small, but gnu/linux code
in mozilla/js/src/prmjtime.c jsdate.c is real mess (IMHO).
Comments like below are explicit:
prmjtime.c:
     * N.B. This hasn't been tested with anything that actually _uses_ 
     * tm_gmtoff; zero might be the wrong thing to set it to if you really need 
     * to format a time.  This fix is for jsdate.c, which only uses 
     * JS_FormatTime to get a string representing the time zone.  */
jsdate.c:
    /* not sure how this affects things, but it doesn't seem 
       to matter. */
    split->tm_isdst = (DaylightSavingTA(timeval) != 0);
Well it matter of me ;-)

So, if you helped with my comments above, may be this problem will
be solve too, soon. Thanks.

Comment 17

[timeless]

Browser:JavaScript Engine, file a bug, but read the other bugs about Date and 
localtime zones before you file.

So can we resolve this bug? it's probably a duplicate of some other bug, but if 
no one wants to look for it, we can use WORKSFORME as the resolution.

Comment 18

[Johnny Stenback (:jst)]

WORKSFORME.

Comment 19

[olecom]

Forgive me please, if i'm so annoying.
This is more about bug in Comment #16.

There's old bug report, even with some tryes to solve it.

Now it seemes like frozen and nobody wants to talk about it.
http://bugzilla.mozilla.org/show_bug.cgi?id=65671
Comments #61-#62