Closed Bug 243998 Opened 20 years ago Closed 20 years ago

Visiting the networkassociates, noggin, upromise crashes Mozilla & Firefox

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: mrtech, Assigned: peterv)

References

(
URL
)

Details

Attachments

(2 files)

bt
9.97 KB, text/plain
Details
Use the right nodeinfo
712 bytes, patch
bzbarsky
: review+
bzbarsky
: superreview+
tor
: approval1.8a1+
Details | Diff | Splinter Review 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a) Gecko/20040518 Firefox/0.8.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a) Gecko/20040518 Firefox/0.8.0+

I frequent this url and starting around this beast build 2004051819 for Firefox
and beast build 2004051817 for Mozilla the url crashes just about when it's done
displaying, have experienced it crash prior to displaying anything also. 

Reproducible: Always
Steps to Reproduce:
1. Go to http://www.networkassociates.com/us/downloads/updates/
2. 
3.

Actual Results:  
That's it, boom it crashes

Expected Results:  
No Crash

This worked with an earlier Beast build today up until about 3-4pm EST
Changing title and adding the following site to list of crashers:
http://www.networkassociates.com/us/downloads/updates/
http://www.noggin.com/
http://www.upromise.com/
Summary: Visiting the McAfee Virus DAT Updates url crashes Mozilla & Firefox → Visiting the networkassociates, noggin, upromise crashes Mozilla & Firefox
Sry, for the spam, just to confirm that this does work with the Mozilla
2004051809 Build, haven't confirmed Firefox yet.
Attached file bt — 
Crash from the second url given in comment 1.  Identical stack to crash from
first url (did not crash on third one).
Crash occurred on recent (~ 2100 PDT) Seamonkey cvs build on Linux. 

Preceding the crash:
###!!! ASSERTION: No nsINodeInfo passed to nsGenericElement, PREPARE TO
CRASH!!!: 'mNodeInfo', file
/home/clfenwi/moz/mozilla/content/base/src/nsGenericElement.cpp, line 807
Break: at file /home/clfenwi/moz/mozilla/content/base/src/nsGenericElement.cpp,
line 807
(13 times) then
ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr !=
0', file ../../../dist/include/xpcom/nsCOMPtr.h, line 711
Break: at file ../../../dist/include/xpcom/nsCOMPtr.h, line 711
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 26570)]
0x410ef442 in nsINodeInfo::GetDocument() const (this=0x0) at nsINodeInfo.h:364
	in nsINodeInfo.h
Status: UNCONFIRMED → NEW
Ever confirmed: true
OS: Windows XP → All
Charles, can you set a breakpoint in nsDebug::Assertion and post the stack to
that assert?  That caller needs fixing.
as requested

#0  nsDebug::Assertion(char const*, char const*, char const*, int)
(aStr=0x415297a0 "No nsINodeInfo passed to nsGenericElement, PREPARE TO
CRASH!!!", aExpr=0x41558961 "mNodeInfo", aFile=0x415293a0
"/home/clfenwi/moz/mozilla/content/base/src/nsGenericElement.cpp", aLine=807) at
nsDebug.cpp:106
#1  0x4126f690 in nsGenericElement (this=0x8b3fae4, aNodeInfo=0x0) at
/home/clfenwi/moz/mozilla/content/base/src/nsGenericElement.cpp:807
#2  0x412fdca2 in nsGenericHTMLElement (this=0x8b3fac8, aNodeInfo=0x0) at
nsGenericHTMLElement.h:83
#3  0x4131ee1a in nsHTMLImageElement (this=0x8b3fac8, aNodeInfo=0x0) at
/home/clfenwi/moz/mozilla/content/html/content/src/nsHTMLImageElement.cpp:193
#4  0x4131ed18 in NS_NewHTMLImageElement(nsIHTMLContent**, nsINodeInfo*)
(aResult=0x415297a0, aNodeInfo=0x0) at
/home/clfenwi/moz/mozilla/content/html/content/src/nsHTMLImageElement.cpp:180
#5  0x410a1539 in CreateHTMLImgElement (aOuter=0x0, aIID=@0x4150429c,
aResult=0xbfffe1e0) at /home/clfenwi/moz/mozilla/layout/build/nsLayoutModule.cpp:649
#6  0x40a69df2 in nsGenericFactory::CreateInstance(nsISupports*, nsID const&,
void**) (this=0x415297a0, aOuter=0x0, aIID=@0x4150429c, aResult=0xbfffe1e0) at
/home/clfenwi/moz/mozilla/xpcom/glue/nsGenericFactory.cpp:82
#7  0x40a2aaad in nsComponentManagerImpl::CreateInstance(nsID const&,
nsISupports*, nsID const&, void**) (this=0x80040154, aClass=@0x8203e50,
aDelegate=0x0, aIID=@0x4150429c, aResult=0xbfffe1e0) at
/home/clfenwi/moz/mozilla/xpcom/components/nsComponentManager.cpp:1876
#8  0x08078f60 in nsCreateInstanceByCID::operator()(nsID const&, void**) const
(this=0xbfffe270, aIID=@0x4150429c, aInstancePtr=0xbfffe1e0) at
nsComponentManagerUtils.cpp:55
#9  0x08078e40 in nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const&, nsID
const&) (this=0xbfffe290, helper=@0x8b3fad8, iid=@0x4150429c) at nsCOMPtr.cpp:114
#10 0x41481c8f in nsCOMPtr<nsISupports>::operator=(nsCOMPtr_helper const&)
(this=0xbfffe290, rhs=@0xbfffe270) at nsCOMPtr.h:896
#11 0x41474ad6 in BaseStubConstructor (name_struct=0x820e694, cx=0x85072b0,
obj=0x862e098, argc=0, argv=0x8b4f3e4, rval=0xbfffe400) at
/home/clfenwi/moz/mozilla/dom/src/base/nsDOMClassInfo.cpp:3348
#12 0x41475239 in DOMJSClass_Construct (cx=0x85072b0, obj=0x862e098, argc=0,
argv=0x8b4f3e4, rval=0xbfffe400) at
/home/clfenwi/moz/mozilla/dom/src/base/nsDOMClassInfo.cpp:3512
#13 0x40070583 in js_Construct (cx=0x85072b0, obj=0x862e098, argc=0,
argv=0x8b4f3e4, rval=0xbfffe400) at /home/clfenwi/moz/mozilla/js/src/jsobj.c:3512
#14 0x40053fce in js_Invoke (cx=0x85072b0, argc=0, flags=1) at
/home/clfenwi/moz/mozilla/js/src/jsinterp.c:1281
#15 0x4005b4a6 in js_Interpret (cx=0x85072b0, result=0xbfffe728) at
/home/clfenwi/moz/mozilla/js/src/jsinterp.c:2942
#16 0x40054761 in js_Execute (cx=0x85072b0, chain=0x87445f8, script=0x8b4eee8,
down=0x0, flags=1095931808, result=0xbfffe728) at
/home/clfenwi/moz/mozilla/js/src/jsinterp.c:1507
#17 0x4002fc5b in JS_EvaluateUCScriptForPrincipals (cx=0x85072b0, obj=0x87445f8,
principals=0x8b0ff2c, chars=0x8b3e320, length=2692, filename=0x8b44048
"http://www.noggin.com/includes/if/rep.js", lineno=1, rval=0xbfffe728) at
/home/clfenwi/moz/mozilla/js/src/jsapi.c:3582
#18 0x4143e71c in nsJSContext::EvaluateString(nsAString const&, void*,
nsIPrincipal*, char const*, unsigned, char const*, nsAString&, int*)
(this=0x8757128, aScript=@0x8b427e0, aScopeObject=0x87445f8,
aPrincipal=0x8b0ff28, aURL=0x8b44048 "http://www.noggin.com/includes/if/rep.js",
aLineNo=1, aVersion=0x40095de7 "default", aRetValue=@0xbfffe840,
aIsUndefined=0xbfffe7dc) at
/home/clfenwi/moz/mozilla/dom/src/base/nsJSEnvironment.cpp:912
#19 0x412c5b6d in nsScriptLoader::EvaluateScript(nsScriptLoadRequest*, nsString
const&) (this=0x8757128, aRequest=0x8b427c8, aScript=@0x8b427e0) at
/home/clfenwi/moz/mozilla/content/base/src/nsScriptLoader.cpp:681
#20 0x412c5797 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest*)
(this=0x8b0fe08, aRequest=0x8b427c8) at
/home/clfenwi/moz/mozilla/content/base/src/nsScriptLoader.cpp:598
#21 0x412c6741 in nsScriptLoader::OnStreamComplete(nsIStreamLoader*,
nsISupports*, unsigned, unsigned, unsigned char const*) (this=0x8b0fe08,
aLoader=0x8b42db0, aContext=0x8b427c8, aStatus=3221220032, stringLen=4294967295,
string=0x8b450c5 "") at
/home/clfenwi/moz/mozilla/content/base/src/nsScriptLoader.cpp:919
#22 0x40d199e6 in nsStreamLoader::OnStopRequest(nsIRequest*, nsISupports*,
unsigned) (this=0x8b42db0, request=0x8b42a30, ctxt=0x8b427c8, aStatus=0) at
/home/clfenwi/moz/mozilla/netwerk/base/src/nsStreamLoader.cpp:132
#23 0x40d18c82 in nsStreamListenerTee::OnStopRequest(nsIRequest*, nsISupports*,
unsigned) (this=0x8b0a390, request=0x8b42a30, context=0x8b427c8, status=0) at
/home/clfenwi/moz/mozilla/netwerk/base/src/nsStreamListenerTee.cpp:65
#24 0x40d9e35f in nsHttpChannel::OnStopRequest(nsIRequest*, nsISupports*,
unsigned) (this=0x8b42a30, request=0x8b44548, ctxt=0x0, status=0) at
/home/clfenwi/moz/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp:3616
#25 0x40cf7124 in nsInputStreamPump::OnStateStop() (this=0x8b44548) at
/home/clfenwi/moz/mozilla/netwerk/base/src/nsInputStreamPump.cpp:505
#26 0x40cf6b80 in nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)
(this=0x8b44548, stream=0x8b44414) at
/home/clfenwi/moz/mozilla/netwerk/base/src/nsInputStreamPump.cpp:340
#27 0x40a18d43 in nsInputStreamReadyEvent::EventHandler(PLEvent*)
(plevent=0x415297a0) at /home/clfenwi/moz/mozilla/xpcom/io/nsStreamUtils.cpp:118
#28 0x40a35971 in PL_HandleEvent (self=0x86c1604) at
/home/clfenwi/moz/mozilla/xpcom/threads/plevent.c:692
#29 0x40a3584a in PL_ProcessPendingEvents (self=0x810bb80) at
/home/clfenwi/moz/mozilla/xpcom/threads/plevent.c:627
#30 0x40a38200 in nsEventQueueImpl::ProcessPendingEvents() (this=0x80e7ce8) at
/home/clfenwi/moz/mozilla/xpcom/threads/nsEventQueue.cpp:391
#31 0x41a04646 in event_processor_callback (source=0x83000c0, condition=G_IO_IN,
data=0x8b3fad8) at /home/clfenwi/moz/mozilla/widget/src/gtk2/nsAppShell.cpp:67
#32 0x40527def in g_io_unix_dispatch () from /opt/gnome/lib/libglib-2.0.so.0
#33 0x40505148 in g_main_dispatch () from /opt/gnome/lib/libglib-2.0.so.0
#34 0x405061a8 in g_main_context_dispatch () from /opt/gnome/lib/libglib-2.0.so.0
#35 0x405065a8 in g_main_context_iterate () from /opt/gnome/lib/libglib-2.0.so.0
#36 0x40506bf7 in g_main_loop_run () from /opt/gnome/lib/libglib-2.0.so.0
#37 0x402296ff in gtk_main () from /opt/gnome/lib/libgtk-x11-2.0.so.0
#38 0x41a04bf0 in nsAppShell::Run() (this=0x8162908) at
/home/clfenwi/moz/mozilla/widget/src/gtk2/nsAppShell.cpp:142
#39 0x4192dad3 in nsAppShellService::Run() (this=0x81374c8) at
/home/clfenwi/moz/mozilla/xpfe/appshell/src/nsAppShellService.cpp:523
#40 0x08062a75 in main1 (argc=1, argv=0xbffff1f4, nativeApp=0x810bb10) at
/home/clfenwi/moz/mozilla/xpfe/bootstrap/nsAppRunner.cpp:1302
#41 0x080633f8 in main (argc=1, argv=0xbffff1f4) at
/home/clfenwi/moz/mozilla/xpfe/bootstrap/nsAppRunner.cpp:1779
OS: All → Windows XP
Taking.
Assignee: general → peterv
Comment on attachment 148814 [details] [diff] [review]
Use the right nodeinfo

NS_NewHTMLOptionElement seems to be fine.
Attachment #148814 - Flags: superreview?(bzbarsky)
Attachment #148814 - Flags: review?(bzbarsky)
Comment on attachment 148814 [details] [diff] [review]
Use the right nodeinfo

Doh.  r+sr=bzbarsky.
Attachment #148814 - Flags: superreview?(bzbarsky)
Attachment #148814 - Flags: superreview+
Attachment #148814 - Flags: review?(bzbarsky)
Attachment #148814 - Flags: review+
Comment on attachment 148814 [details] [diff] [review]
Use the right nodeinfo

Trivial fix for a crasher. No risk.
Attachment #148814 - Flags: approval1.8a1?
*** Bug 244056 has been marked as a duplicate of this bug. ***
*** Bug 244050 has been marked as a duplicate of this bug. ***
Attachment #148814 - Flags: approval1.8a1? → approval1.8a1+
*** Bug 244051 has been marked as a duplicate of this bug. ***
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
*** Bug 244105 has been marked as a duplicate of this bug. ***
*** Bug 244136 has been marked as a duplicate of this bug. ***
Duh, thanks for fixing this peterv!
*** Bug 244147 has been marked as a duplicate of this bug. ***
*** Bug 244341 has been marked as a duplicate of this bug. ***
*** Bug 244376 has been marked as a duplicate of this bug. ***
Component: Browser-General → DOM: HTML
QA Contact: general → ian
Component: DOM: HTML → DOM: Core & HTML
QA Contact: ian → general
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: