255546 - Freeze of firefox after loading a website

Status: RESOLVED FIXED

(Core :: Internationalization, defect)

Description

[Robert Nagy]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3.2; OpenBSD) (KHTML, like Gecko)
Build Identifier: 

 

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Actual Results:  
Freeze 


++WEBSHELL == 3 
++DOMWINDOW == 3 
Note: frameverifytree is disabled 
*** screen res > 600px high 
###!!! ASSERTION: Truncate cannot make string longer: 'newLength <= mLength', 
file ../../../dist/include/string/nsTSubstring.h, line 279 
Break: at file ../../../dist/include/string/nsTSubstring.h, line 279 
^C 
Program received signal SIGINT, Interrupt. 
nsCSubstring::MutatePrep (this=0xcfbfb014, capacity=4294967295, 
oldData=0xcfbfaf1c, oldFlags=0xcfbfaf20) 
    at nsTSubstring.cpp:81 
81                    temp <<= 1; 
(gdb) bt 
#0  nsCSubstring::MutatePrep (this=0xcfbfb014, capacity=4294967295, 
oldData=0xcfbfaf1c, oldFlags=0xcfbfaf20) 
    at nsTSubstring.cpp:81 
#1  0x0e6d41e1 in nsCSubstring::SetCapacity (this=0xcfbfb014, 
capacity=4294967295) at nsTSubstring.cpp:456 
#2  0x0e6d42b5 in nsCSubstring::SetLength (this=0xcfbfb014, length=4294967295) 
at nsTSubstring.cpp:484 
#3  0x02980350 in nsCharsetMenu::UpdateCachePrefs (this=0x7cf4a700, 
aCacheKey=0x2295d780 "intl.charsetmenu.browser.cache", 
    aCacheSizeKey=0x2295dc20 "intl.charsetmenu.browser.cache.size", 
    aStaticKey=0x2295d500 "intl.charsetmenu.browser.static", 
aCharset=0x86d66740) 
    at ../../../dist/include/string/nsTSubstring.h:280 
#4  0x029812e5 in nsCharsetMenu::SetCurrentCharset (this=0x7cf4a700, 
aCharset=0x86d66740) at nsCharsetMenu.cpp:1856 
#5  0x0e6c7f76 in XPTC_InvokeByIndex (that=0x7cf4a704, methodIndex=3, 
paramCount=1, params=0xcfbfb360) 
    at xptcinvoke_unixish_x86.cpp:130 
#6  0x0059725b in XPCWrappedNative::CallMethod (ccx=@0xcfbfb428, 
mode=CALL_METHOD) at xpcwrappednative.cpp:2027 
#7  0x005a0d36 in XPC_WN_CallMethod (cx=0x7fb66000, obj=0x88aeb038, argc=1, 
argv=0x857530c0, vp=0xcfbfb548) 
    at xpcwrappednativejsops.cpp:1287 
#8  0x02df992a in js_Invoke (cx=0x7fb66000, argc=1, flags=0) at jsinterp.c:941 
#9  0x02e03525 in js_Interpret (cx=0x7fb66000, result=0xcfbfb7d4) at 
jsinterp.c:2972 
#10 0x02df9990 in js_Invoke (cx=0x7fb66000, argc=2, flags=2) at jsinterp.c:958 
#11 0x02df9bec in js_InternalInvoke (cx=0x7fb66000, obj=0x80e03088, 
fval=2086241368, flags=2, argc=2, argv=0x8689adf0, 
    rval=0xcfbfb9f4) at jsinterp.c:1035 
#12 0x02dd5571 in JS_CallFunctionValue (cx=0x7fb66000, obj=0x80e03088, 
fval=2086241368, argc=2, argv=0x8689adf0, 
    rval=0xcfbfb9f4) at jsapi.c:3607 
#13 0x09a7fe20 in nsJSContext::CallEventHandler (this=0x7f1d2a00, 
aTarget=0x80e03088, aHandler=0x7c598458, argc=2, 
    argv=0x8689adf0, rval=0xcfbfb9f4) at nsJSEnvironment.cpp:1296 
#14 0x09aa34bd in GlobalWindowImpl::RunTimeout (this=0x7df13400, 
aTimeout=0x8082a580) at nsGlobalWindow.cpp:5152 
#15 0x09aa44b3 in GlobalWindowImpl::TimerCallback (aTimer=0x80830a40, 
aClosure=0x8082a580) at nsGlobalWindow.cpp:5512 
#16 0x0e6a31f3 in nsTimerImpl::Fire (this=0x80830a40) at nsTimerImpl.cpp:382 
#17 0x0e6a3370 in handleTimerEvent (event=0x834d1280) at nsTimerImpl.cpp:447 
#18 0x0e69b71f in PL_HandleEvent (self=0x834d1280) at plevent.c:673 
#19 0x0e69b5ec in PL_ProcessPendingEvents (self=0x7ce13000) at plevent.c:608 
#20 0x0e69e49b in nsEventQueueImpl::ProcessPendingEvents (this=0x81377fc0) at 
nsEventQueue.cpp:391 
#21 0x0e6ffeeb in event_processor_callback (data=0x81377fc0, source=10, 
condition=GDK_INPUT_READ) at nsAppShell.cpp:186 
#22 0x0e6ffa76 in our_gdk_io_invoke (source=0x803591a0, condition=G_IO_IN, 
data=0x80359150) at nsAppShell.cpp:72 
#23 0x0216e5f0 in g_io_unix_dispatch () from /usr/local/lib/libglib.so.1.2 
#24 0x0216fca8 in g_main_dispatch () from /usr/local/lib/libglib.so.1.2 
#25 0x021702b3 in g_main_iterate () from /usr/local/lib/libglib.so.1.2 
#26 0x0217044c in g_main_run () from /usr/local/lib/libglib.so.1.2 
#27 0x009ac067 in gtk_main () from /usr/local/lib/libgtk.so.1.2 
#28 0x0e700800 in nsAppShell::Run (this=0x822bb4a0) at nsAppShell.cpp:317 
#29 0x0b092b87 in nsAppShellService::Run (this=0x7ce13380) at 
nsAppShellService.cpp:494 
---Type <return> to continue, or q <return> to quit--- 
#30 0x1c015571 in xre_main (argc=1, argv=0xcfbfc430, aAppData=0x3c005044) at 
nsAppRunner.cpp:1977 
#31 0x1c0097cc in main (argc=1, argv=0xcfbfc430) at nsBrowserApp.cpp:58

Comment 1

[Robert Nagy]

OpenBSD-3.5, gcc 2.95.3 (propolice). 
configure args: --with-pthreads --enable-xft --enable-optimize=-Os 
--enable-debug --disable-tests --disable-pedantic --disable-installer 
--disable-ldap --disable-mailnews 
--enable-extensions=cookie,xml-rpc,xmlextras,p3p,pref,transformiix,universalchardet,typeaheadfind,webservice 
s --enable-crypto --disable-composer 
 
CFLAGS+= -fno-stack-protector 
 
gtk+-1.2.10 
glib-1.2.10 
 
XFree86 Version 4.3.99.902 (4.4.0 RC 2) (for OpenBSD) 
Release Date: 18 December 2003 
X Protocol Version 11, Revision 0, Release 6.6 
Build Operating System: OpenBSD 3.5 i386 [ELF] 
Current Operating System: OpenBSD enterprise.hu 3.6 ENTERPRISE#5 i386 
Build Date: 29 July 2004 
Changelog Date: 29 February 2004 
        Before reporting problems, check http://www.XFree86.Org/ 
        to make sure that you have the latest version. 
Module Loader present 
 
 
 
 

Comment 2

[timeless]

the problem is that it's doing RFindChar
which is returning kNotFound
which is -1
line 1643 according to lxr
i'm fairly certain that's the Truncate line
one sec
381       void Truncate( size_type newLength = 0 )
382         {
383           NS_ASSERTION(newLength <= mLength, "Truncate cannot make string
longer");
384           SetLength(newLength);
385         }
yeah. you're being called w/ -1
we shouldn't pass output from RFind into Truncate
the lines of interest according to lxr are:
1642     if ((cacheSize - 1) < (PRInt32) strCachePrefValue.CountChar(','))
1643       strCachePrefValue.Truncate(strCachePrefValue.RFindChar(','));
RFindChar will return kNotFound (-1) if the string doesn't have the item
and Truncate of course wants a nonnegative number

Comment 3

[Frank Wein [:mcsmurf]]

Attachment: Patch

Can someone (Reporter :)?) test this patch? It should work, but i can't test it
right now.

Comment 4

[Jungshik Shin]

(In reply to comment #2)

> we shouldn't pass output from RFind into Truncate
> the lines of interest according to lxr are:
> 1642     if ((cacheSize - 1) < (PRInt32) strCachePrefValue.CountChar(','))
> 1643       strCachePrefValue.Truncate(strCachePrefValue.RFindChar(','));
> RFindChar will return kNotFound (-1) if the string doesn't have the item
> and Truncate of course wants a nonnegative number

  It shouldn't return '-1' unless intl.charsetmenu.browser.cache.size
(cacheSize) is 0 or less. Anyway, it should be wall-papered. A patch coming up. 

Comment 5

[Jungshik Shin]

Attachment: patch

wall-paper it and 'modernize' the string usage a bit.

Comment 6

[Frank Wein [:mcsmurf]]

(In reply to comment #5)
> Created an attachment (id=156058)
> patch
> 
> wall-paper it and 'modernize' the string usage a bit.

i guess my patch is obsolete then?

Comment 7

[Robert Nagy]

Your patch fixed it, thanks. But can u tell me why 
intl.charsetmenu.browser.cache.size is 0? 

Comment 8

[Jungshik Shin]

Attachment: patch v2

basically the same as before. I realized that the failure from
|mPrefs->GetCharPref| shoul be handled gracefully.

Comment 9

[Jungshik Shin]

(In reply to comment #7)
> Your patch fixed it, thanks. But can u tell me why 
> intl.charsetmenu.browser.cache.size is 0? 

That's what I wanted to ask :-) Did you set it to 0? It's 5 by default. 

Comment 10

[Jungshik Shin]

Comment on attachment 156075 [details] [diff] [review]
patch v2

asking for r/sr

Comment 11

[Robert Nagy]

I don't have it by default. So i assume it is 0.

Comment 12

[Jungshik Shin]

(In reply to comment #11)
> I don't have it by default. So i assume it is 0.

Really? Doesn't it show up in 'about:config'? It should

Comment 13

[Robert Nagy]

It does not. I needed to add this patch to get tabbing work: 
 
--- browser/app/profile/firefox.js.orig Fri Aug 13 14:27:18 2004 
+++ browser/app/profile/firefox.js      Fri Aug 13 14:30:13 2004 
@@ -151,6 +151,8 @@ 
 pref("browser.tabs.loadBookmarksInBackground", false); 
 
 // Smart Browsing prefs 
+pref("browser.tabs.autoHide", true); 
+pref("browser.tabs.forceHide", false); 
 pref("browser.related.enabled", true); 
 pref("browser.related.autoload", 1);  // 0 = Always, 1 = After first use, 2 = 
Never 
 pref("browser.related.provider", "http://www-rl.netscape.com/wtgn?"); 
 
I think my build misses a lot of default settings, and i fuckin don't know 
why. Weird.. 
 

Comment 14

[[e-mail]]

Comment on attachment 156075 [details] [diff] [review]
patch v2

sr=me if you address these nits:

>+  rv = mPrefs->GetCharPref(aCacheKey, getter_Copies(cachePrefValue));
>+  if (NS_FAILED(rv)) cachePrefValue.Truncate();
>+  rv = mPrefs->GetCharPref(aStaticKey, getter_Copies(staticPrefValue));
>+  if (NS_FAILED(rv)) staticPrefValue.Truncate();
You shouldn't need these Truncate()s because getter_Copies only changes the
nsXPIDLCString if the return pointer is not null.

>+  if ((cachePrefValue.Find(currentCharset) == -1) && 
>+      (staticPrefValue.Find(currentCharset) == -1)) {
While you're changing this please use kNotFound instead.

>-    strCachePrefValue.Insert(currentCharset, 0);
>-    if ((cacheSize - 1) < (PRInt32) strCachePrefValue.CountChar(','))
>-      strCachePrefValue.Truncate(strCachePrefValue.RFindChar(','));
>+    cachePrefValue.Insert(currentCharset, 0);
>+    if ((cacheSize - 1) < (PRInt32) cachePrefValue.CountChar(','))
>+      cachePrefValue.Truncate(cachePrefValue.RFindChar(','));
Personally I find the (x - 1) < y test odd as opposed to x <= y although x < (y
+ 1) would be the most descriptive test.

>-    res = mPrefs->SetCharPref(aCacheKey, PromiseFlatCString(strCachePrefValue).get());
>+    rv = mPrefs->SetCharPref(aCacheKey, cachePrefValue.get());
As you're using an nsXPIDLCString, this might work without the .get()?

Comment 15

[Simon Montagu :smontagu]

Comment on attachment 156075 [details] [diff] [review]
patch v2

r=smontagu

Comment 16

[Frank Wein [:mcsmurf]]

jshin: You can checkin this patch (and address the comments for this patch)?

Comment 17

[Jungshik Shin]

thanks for reminding me. fix checked into the trunk

Comment 18

[Jungshik Shin]

Attachment: what's checked into the trunk

for the record and to ask for a1.7/aviary-1.0