253192 - jsd xpconnect trampled on js context

Status: RESOLVED INCOMPLETE

(Other Applications Graveyard :: Venkman JS Debugger, defect)

Description

[timeless]

this is not a debug build
this does not have any of my untested random changes to c/c++ code.

i'm using venkman to debug a script which is playing with dom nodes. the code in
question is fairly harmless and not even very interesting.

at some point, my mostly reasonable array was trampled:

0001: uneval(newxpatharray)
$[4] = [string] "[\"[xpconnect wrapped jsdIStackFrame]\", \"\"]"

the array does not play with xpconnect, nor does it play with debugging
mechanisms. nor does the code do much with try blocks nor does the code play
with regular expressions.


     1 
     2     function buildXPath(node, namespaces) {
 -   3         var newxpatharray = new this.JS_Array();
 -   4         newxpatharray.push("");
 -   5         var o = node, a;
<->  6         while (node) {
 -   7             if (node.nodeType == Node.DOCUMENT_NODE) {
 -   8                 node = node.defaultView.frameElement;
 -   9                 if (!node) {
 -  10                     if (newxpatharray.length == 1 &&
 -  11                         newxpatharray[0].length == 0) {
 -  12                         newxpatharray[0] = "/";
    13                     }
 -  14                     break;
    15                 }
 -  16                 newxpatharray.unshift("");
    17             }
 -  18             var extra = "", value;
 -  19             var curr = node, sibling = 0;
 -  20             while ((curr = curr.nextSibling)) {
 -  21                 if (curr.nodeType == Node.ELEMENT_NODE &&
 -  22                     curr.nodeName == node.nodeName) {
 -  23                     while ((curr = curr.previousSibling)) {
 -  24                         if (curr.nodeType == Node.ELEMENT_NODE &&
 -  25                             curr.nodeName == node.nodeName) {
 -  26                             ++sibling;
    27                         }
    28                     }
 -  29                     extra += "[" + sibling + "]";
 -  30                     break;
    31                 }
    32             }
 -  33             const fields = ["href", "target", "src", "data", "type",
"name", "id", ];
 -  34             for (i in fields) {
 -  35                 try {
 -  36                     if ((value = node.getAttribute([fields[i]]))) {
 -  37                         extra += "[@" + fields[i] + "=\"" + escape(value)
+ "\"]";
    38                     }
 -  39                 } catch (e) {
    40                 }
    41             }
 -  42             var nodeName = node.nodeName;
 -  43             var namespaceURI = node.namespaceURI;
 -  44             var nodePrefix = "";
 -  45             if (namespaceURI) {
 -  46                 if (namespaceURI in namespaces) {
 -  47                     nodePrefix = namespaces[namespaceURI];
    48                 } else {
 -  49                     nodePrefix = namespaces[namespaceURI] = "a" +
namespaces[''].push(namespaces[namespaceURI]);
    50                 }
 -  51                 nodeName = nodePrefix + ":" + nodeName;
    52             }
 -  53             extra = "/" + nodeName + extra;
 -  54             node = node.parentNode;
 B  55             newxpatharray[0] = extra + newxpatharray[0];
    56         }
 B  57         return newxpatharray;
    58     }
    59 

i wonder if this is my smoking gun. after running along through the loop until
it finished, and then triggering the code a second time, my mozilla crashed.

note that this code is not bug free and was just code i was reprototyping (hence
venkman). this.JS_Array is an alias to Array.

bulidXPath is called with ([DOMHTMLDocument], {'':[]})

The output of the last calls to buildXPath:

{xpath:["/HTML/FRAMESET/FRAME[1][@src=\"leftFrame.html\"][@name=\"leftFrame\"]",
"/HTML/BODY/UL/LI[1]/A[@href=\"frame01.html\"][@target=\"rightFrame\"]"]}
{xpath:["[xpconnect wrapped jsdIStackFrame][xpconnect wrapped
jsdIStackFrame][xpconnect wrapped jsdIStackFrame]", ""]}
{xpath:["truetruetrue", "truetruetruetruetrue"]}
{xpath:["undefinedundefinedundefined", ""]}
{xpath:["208754482087544820875448", "2087544820875448208754482087544820875448"]}
{xpath:"['/']"}
{xpath:["[xpconnect wrapped jsdIStackFrame][xpconnect wrapped
jsdIStackFrame][xpconnect wrapped jsdIStackFrame]}

Comment 1

[timeless]

 B  55             newxpatharray[0] = extra + newxpatharray[0];

is the problem. it doesn't seem to happen the first few times through, but it
will happen eventually and once it has happened it's pretty consistent.

Comment 2

[Alex Vincent [:WeirdAl]]

timeless: over three years have passed since you originally filed this bug.  Can you still reproduce it?

Comment 3

[BMO Automation]

Component is obsolete so resolving bugs as INCOMPLETE