265599 - crash in [@ GtkPromptService::Prompt]

Status: RESOLVED FIXED

(Core Graveyard :: Embedding: GTK Widget, defect)

Description

[Christian Persch (GNOME) (away; not receiving bug mail)]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.2) Gecko/20040803 Galeon/1.3.17.99
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20041019 Firefox/1.0

GtkPromptService::Prompt assumes that if aCheckMsg != nsnull then also
aCheckValue != nsnull. But on aviary branch, nsSingleSignonPrompt::Prompt passes
a .get() on an nsAutoString but only sets aCheckValue conditionally,
http://lxr.mozilla.org/aviarybranch/source/toolkit/components/passwordmgr/base/nsSingleSignonPrompt.cpp#64

Reproducible: Always
Steps to Reproduce:
1. Load the testcase
2. Move mouse over the "Open this link in new tab" link
3. Wait 6 seconds for the testcase's timeout

Actual Results:  
Crash.

Expected Results:  
Prompt pops up.

Trace, unfortunately no debug build:

#0  0x001b6e54 in GtkPromptService::Prompt () from ./libgtkembedmoz.so
#1  0x00278447 in nsPrompt::Prompt () from
/opt/firefox/lib/firefox-1.0/components/libembedcomponents.so
#2  0x00e9e571 in nsSingleSignonPrompt::Prompt () from
/opt/firefox/lib/firefox-1.0/components/libtoolkitcomps.so
#3  0x01457f28 in GlobalWindowImpl::Prompt () from
/opt/firefox/lib/firefox-1.0/components/libgklayout.so
#4  0x014582b4 in GlobalWindowImpl::Prompt () from
/opt/firefox/lib/firefox-1.0/components/libgklayout.so
#5  0x006ee20f in XPTC_InvokeByIndex () from ./libxpcom.so
#6  0x002da477 in XPCWrappedNative::CallMethod () from
/opt/firefox/lib/firefox-1.0/components/libxpconnect.so
#7  0x002e0572 in XPC_WN_CallMethod () from
/opt/firefox/lib/firefox-1.0/components/libxpconnect.so
#8  0x0094fd0e in js_Invoke () from ./libmozjs.so
#9  0x00959508 in js_Interpret () from ./libmozjs.so
#10 0x00950352 in js_Execute () from ./libmozjs.so
#11 0x009304b2 in JS_EvaluateUCScriptForPrincipals () from ./libmozjs.so
#12 0x0144e518 in nsJSContext::EvaluateString () from
/opt/firefox/lib/firefox-1.0/components/libgklayout.so
#13 0x0145f21f in GlobalWindowImpl::RunTimeout () from
/opt/firefox/lib/firefox-1.0/components/libgklayout.so
#14 0x0145f99f in GlobalWindowImpl::TimerCallback () from
/opt/firefox/lib/firefox-1.0/components/libgklayout.so
#15 0x006d9dae in nsTimerImpl::Fire () from ./libxpcom.so
#16 0x006d9e1b in handleTimerEvent () from ./libxpcom.so
#17 0x006d5fc7 in PL_HandleEvent () from ./libxpcom.so
#18 0x006d5ef9 in PL_ProcessPendingEvents () from ./libxpcom.so
#19 0x006d7832 in nsEventQueueImpl::ProcessPendingEvents () from ./libxpcom.so
#20 0x00c6c63e in event_processor_callback () from
/opt/firefox/lib/firefox-1.0/components/libwidget_gtk2.so
#21 0x0599fa2f in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#22 0x05978e9b in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#23 0x0597aac4 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0
#24 0x0597ad8a in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#25 0x00a9ec33 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#26 0x08049ebb in main ()

The crash happens in GtkPromptService.cpp on this line
http://lxr.mozilla.org/aviarybranch/source/embedding/browser/gtk/src/GtkPromptService.cpp#176
:
176         prompter.SetCheckValue(*aCheckValue);

because aCheckValue is 0.

Comment 1

[Christian Persch (GNOME) (away; not receiving bug mail)]

I forgot to mention that you have to load the testcase in TestGtkEmbed, not in
firefox.

As for the fix, should we
- fix the assumption in GtkPromptService, or
- fix nsSingleSignonPrompt to pass nsnull instead of "" when aCheckValue is also
nsnull ?

Comment 2

[Christopher Blizzard (:blizzard)]

-> marco

Comment 3

[Christian Persch (GNOME) (away; not receiving bug mail)]

Attachment: fix

Comment 4

[Christian Persch (GNOME) (away; not receiving bug mail)]

See also bug 199421 where the same change was made to ::ConfirmEx.

Comment 5

[Christian Persch (GNOME) (away; not receiving bug mail)]

Attachment: updated patch

Also make sure aCheckValue isn't 0 in ::AlertCheck and ::ConfirmCheck.

Comment 6

[Marco Pesenti Gritti]

Comment on attachment 163425 [details] [diff] [review]
updated patch

Nitpick of the day, you should probably put a new line between NS_ENSURE_ARG
and EmbedPrompter (AlertCheck and ConfirmCheck)

Comment 7

[Christian Persch (GNOME) (away; not receiving bug mail)]

Attachment: nit fixed

Comment 8

[Christian Persch (GNOME) (away; not receiving bug mail)]

Comment on attachment 163429 [details] [diff] [review]
nit fixed

Transferring r=marco, and asking for sr.

Comment 9

[Luis Villa]

Still happening, so confirming. Can we get an sr=, please? :)

Comment 10

[Christian Persch (GNOME) (away; not receiving bug mail)]

Comment on attachment 163429 [details] [diff] [review]
nit fixed

This is also needed on trunk. Fixes an embedding-only crash, no risk.

Comment 11

[Christian :Biesinger (don't email me, ping me on IRC)]

Checking in embedding/browser/gtk/src/GtkPromptService.cpp;
/cvsroot/mozilla/embedding/browser/gtk/src/GtkPromptService.cpp,v  <-- 
GtkPromptService.cpp
new revision: 1.8; previous revision: 1.7
done

Comment 12

[Christian Persch (GNOME) (away; not receiving bug mail)]

Marking fixed.

Comment 13

[Daniel Veditz [:dveditz]]

Comment on attachment 163429 [details] [diff] [review]
nit fixed

a=dveditz for drivers

Comment 14

[timeless]

Comment on attachment 163429 [details] [diff] [review]
nit fixed

mozilla/embedding/browser/gtk/src/GtkPromptService.cpp 	1.6.16.1 	MOZILLA_1_7_BRANCH
mozilla/embedding/browser/gtk/src/GtkPromptService.cpp 	1.6.32.1 	AVIARY_1_0_1_20050124_BRANCH

Comment 15

[Marcia Knous [:marcia]]

verified fixed on the 1.0.1 branch using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20060212 Firefox/1.0.7. Running the testcase URL produces no crash. Adding verified-aviary1.0.8 keyword.

Comment 16

[Marcia Knous [:marcia]]

verified fixed on the 1.0.1 branch using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20060212 Firefox/1.0.7. Running the testcase URL produces no crash. Adding verified-aviary1.0.8 keyword.