277484 - Firefox crashes when button on statusbar is hidden and javascript popup [@ nsStackLayout::GetAscent]

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Michael Lidman]

If an extention adds a button to the status bar and then hides the button, when
a javascript window with the statusbar hidden firefox will crash

I mantain an extention called autocopy. It has a status bar button that can
optionaly be hidden. To test this out install autocopy from autocopy.mozdev.org
and changes autocopy's opptions to diable the statusbar button. Then go to a
site that opens a javascript window where the javascript specifies that the
statusbar be hidden. Firefox will crash badly

Comment 1

[Michael Lidman]

Here a little more detail. If that statusbarpanel in the xul file does not set
the hidden attribute and you hide the startusbar button using javascript 

setAttribute("hidden", true)

Now if a javascrip popup pops up using code like this

window.open(URL, '" + id + "',
'statusbar=0,menubar=0,resizable=0,width=200,height=200,left = 412,top = 284');

Then firefox throughs an exception.

The solution is to set the hidden attribute for the statusbarpanel in the xul
file. Or I suppose you could use a try catch block. 

So whatever, thank you for spending the time to read this if you found this bug
in your way. 

Comment 2

[Mike Connor [:mconnor]]

What's the exception thrown here?  Also, do you have a talkback ID by chance for
the crash?  This doesn't sound quite right, we shouldn't potentially crash in
this case.

Comment 3

[Michael Lidman]

Here is a talkback ID for a crash I had working on this

TB3261213X

I wasn't able to catch the exception. I tryed try/catching in a number of
places. Even though I know that it craches when i get to this line 

autocopyStatusBarButton.setAttribute("hidden", true);

in a function that is called with an event listener.

window.addEventListener("load",function() {initAutoCopyStatus();} ,true);

One more thing. If I change that line to

window.addEventListener("load",function() {initAutoCopyStatus();} ,false);

firefox will not crash even if I fail to set the hidden atribute in the
statusbarpanel tag

Also seting the statusbarpanel tag from hidden="true" to hidden="false" makes a
difference. The crash problem only goes away if you set it to "true" but not false

Comment 4

[timeless]

Build ID	2004110711
Trigger Time	2005-01-24 10:03:17.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001573d9)
URL visited	
User Comments	
Since Last Crash	440 sec
Total Uptime	1848889 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsStackLayout.cpp,
line 172
Stack Trace 	
nsStackLayout::GetAscent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsStackLayout.cpp,
line 172]
nsBoxFrame::RemoveFrame 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1121]
nsFrameManager::RemoveFrame 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsFrameManager.cpp,
line 757]
nsCSSFrameConstructor::ContentRemoved 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 9535]
nsCSSFrameConstructor::RecreateFramesForContent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 11358]
nsCSSFrameConstructor::AttributeChanged 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 10115]
PresShell::AttributeChanged 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5198]
nsXULElement::SetAttrAndNotify 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2225]
nsXULElement::SetAttr 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2148]
nsXULElement::SetAttribute 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 1022]
XPTC_InvokeByIndex 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_CallMethod 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 941]
js_Interpret 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2978]
js_Invoke 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 958]
nsXPCWrappedJSClass::CallMethod 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1339]
nsXPCWrappedJS::CallMethod 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
nsEventListenerManager::HandleEventSubType 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1436]
nsEventListenerManager::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1516]
GlobalWindowImpl::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 927]
nsXULDocument::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1257]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2823]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleChromeEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 916]
DocumentViewerImpl::LoadComplete 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocumentViewer.cpp,
line 917]
nsDocShell::EndPageLoad 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 4441]
nsWebShell::EndPageLoad 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/docshell/base/nsWebShell.cpp,
line 755]
nsDocShell::OnStateChange 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 4375]
nsDocLoaderImpl::FireOnStateChange 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 1247]
nsDocLoaderImpl::doStopDocumentLoad 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 868]
nsDocLoaderImpl::OnStopRequest 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/uriloader/base/nsDocLoader.cpp,
line 696]
nsLoadGroup::RemoveRequest 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsLoadGroup.cpp,
line 695]
nsInputStreamChannel::OnStopRequest 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/netwerk/base/src/nsInputStreamChannel.cpp,
line 371]
nsInputStreamChannel::`vftable'
XULContentSinkImpl::AddRef 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULContentSink.cpp,
line 436]
0x8b560c45

Comment 5

[Boris Zbarsky [:bzbarsky]]

RemoveFrame does not call GetAscent, so at least that part is bogus.

Is this a problem with a trunk build?

Comment 6

[Michael Lidman]

I tried
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/firefox-1.0+.en-US.win32.zip

I created a new profile and installed autocopy with the faulty code and varified
that firefox 1.0 was crashing as described above. Then I opened the latest-trunk
version and tested it. I did not see the same crashing problem 

latest-trunk 26-Jan-2005 16:39 	6.3M no longer has this problem 

Comment 7

[Boris Zbarsky [:bzbarsky]]

OK.  Marking worksforme...