284343 - crash on return of webservice with custom typemapping

Status: RESOLVED DUPLICATE of bug 271560

(Firefox :: General, defect)

Description

[Cory]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050225 Firefox/1.0.1
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050225 Firefox/1.0.1

Firefox segfaults when the webservice callback receives the results of a call
that returns a custom type. Core dumps available.

Here is a XUL app to demonstrate:

================================================
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window id="example-window" title="Example 2.2.1"
            xmlns:html="http://www.w3.org/1999/xhtml"
            xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

    <script type="application/x-javascript">              

var gProxy = null;

function Foo(){
    if (!gProxy) {
        
    var listener = {

      // gets called once the proxy has been instantiated
      onLoad: function (aProxy)
      {
        gProxy = aProxy;
        gProxy.setListener(listener);
        requestUsers();
      },

      // gets called if an error occurs
      onError: function (aError)
      {
        alert("An error has occured: " + aError);
      },

      // callback function is hardcoded to {methodname}Callback
      getUsersCallback : function (aResult)
      {
        dump("Result: " + aResult);
        },

      getXMLConfigCallback : function (aResult) {
        dump("XML Config: " + aResult);
      }
    };

    createProxy(listener);
    } else {
    alert("Calling requestQuote()");
    requestUsers();
    alert("Done calling requestQuote()");
  }
}

function createProxy(aCreationListener){
  try {
    var factory = new WebServiceProxyFactory();
   
factory.createProxyAsync('http://127.0.0.1:8080/axis/services/ConfigService_Port?wsdl',
"ConfigService_Port", "", true, aCreationListener);
  } catch (ex) {
    alert("Failed creating the proxy: "+ ex);
  }
}

function requestUsers(){
  if (gProxy) {
  netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead"); 
    
    gProxy.getUsers();
  } else {
    alert("Error: Proxy hasn't been set up correctly!");
  }
}
</script>
<button label="Normal" onclick="Foo()"/>
</window>
================================================

The getUsers() method returns a type defined in the WSDL as such:

================================================
            <xsd:complexType name="UserBean">
                <xsd:sequence>
                    <xsd:element name="certDN"    type="xsd:string"/>
                    <xsd:element name="firstName" type="xsd:string"/>
                    <xsd:element name="lastName"  type="xsd:string"/>
                    <xsd:element name="nickname"  type="xsd:string"/>
                </xsd:sequence>
            </xsd:complexType>
            <xsd:complexType name="ArrayOfUserBean">
                <xsd:complexContent>
                    <xsd:restriction base="soapenc:Array">
                        <xsd:attribute ref="soapenc:arrayType"
arrayType="ns:UserBean[]"/>
                    </xsd:restriction>
                </xsd:complexContent>
            </xsd:complexType>
================================================

Here's the interesting bits of the Core dump from gdb:

================================================
(gdb) where
#0  0x006587a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x0011c734 in raise () from /lib/tls/libpthread.so.0
#2  0x0878325a in nsPRUint32Key::Clone ()
#3  <signal handler called>
#4  0x0870de38 in nsPRUint32Key::Clone ()
#5  0x0870b257 in nsPRUint32Key::Clone ()
#6  0x0871735c in nsPRUint32Key::Clone ()
#7  0x087348ab in nsPRUint32Key::Clone ()
#8  0x087317be in nsPRUint32Key::Clone ()
#9  0x08731025 in nsPRUint32Key::Clone ()
#10 0x08714e9b in nsPRUint32Key::Clone ()
#11 0x086a39e2 in nsPRUint32Key::Clone ()
#12 0x086a501a in nsPRUint32Key::Clone ()
#13 0x086a4eb9 in nsPRUint32Key::Clone ()
================================================

Reproducible: Always

Steps to Reproduce:
1. load the XUL file from disk
2. click on the button in the XUL app
3. allow user privaledges for app to execute webservice call
BOOM!

Actual Results:  
Firefox immediately shut down and produced a core dump.

Expected Results:  
not crashed.  :oP
It should have dumped the object to the javascript console or given me some
other error.

Linux cory.XXX.com 2.6.10-1.766_FC3 #1 Wed Feb 9 23:06:42 EST 2005 i686 i686
i386 GNU/Linux
glibc-devel-2.3.4-2.fc3
glibc-2.3.4-2.fc3

Comment 1

[Matthias Versen [:Matti]]

Please provide a talkback ID

Comment 2

[Cory]

(In reply to comment #1)
> Please provide a talkback ID

For some reason I cannot send the talkback data from my Quality Feedback app. I
get network errors, ("Receive Failed"). Are there any files that I could simply
upload or email?

Comment 3

[Cory]

Found a news post on n.p.m.xml by "Gardner  Lloyd Bickford III" regarding a
similar problem. The solution was to set the AXIS app server's 'sendMultiRefs'
option to 'false'. After doing so, firefox no longer crashes and the desired
behavior occurs. So maybe its a bug in the SOAP logic...

hope that helps,
- Cory

Comment 4

[Matthias Versen [:Matti]]

It's difficult without Talkback ID or a stack trace...

Comment 5

[Chris Rauschuber]

Attachment: PHP Web Service

Comment 6

[Chris Rauschuber]

Attachment: WSDL

Comment 7

[Chris Rauschuber]

Attachment: Client

Comment 8

[Chris Rauschuber]

I can reproduce this with the Mozilla's Amazon example:
http://www.mozilla.org/projects/webservices/examples/mozilla-wsdl/index.html

Fedora Core 3(2.6.10-1.770_FC3)
Firefox 1.0.2

I did make the security change needed to run it:
user_pref("signed.applets.codebase_principal_support", true);

I can also reproduce it with a Hello World php web service(attached php,
produced wsdl and client javascript).

Comment 9

[Chris Rauschuber]

Talkback Id: TB4967398G

This talkback report is from a different machine than the one above, but it is
experiencing the same problem.

Comment 10

[timeless]

*** This bug has been marked as a duplicate of 271560 ***