294378 - Crash opening window node in DOM Inspector

Status: RESOLVED FIXED

(Other Applications :: DOM Inspector, defect)

Description

[Dainis Jonitis]

1. Open "about:" in Mozilla window
2. Open DOM Inspector
3. Select "File"-"Inspect a Window"-"About: - Mozilla ..."
4. Dispaly "Document - DOM Nodes" in the left pane
5. Click on the "window" row right under "#document" row. Right pane is updated
6. Click on the "+" sign of "window" row to expand. Crash in inspector.dll

Stack:
	inspector.dll!nsCOMPtr<nsIBindingManager>::get()  Line 831 + 0x3	C++
 	inspector.dll!nsCOMPtr<nsIBindingManager>::operator
nsDerivedSafe<nsIBindingManager> *()  Line 844	C++
 	inspector.dll!nsIDocument::BindingManager()  Line 533	C++
 	inspector.dll!inLayoutUtils::GetBindingManagerFor(nsIDOMNode *
aNode=0x02c662f4)  Line 227 + 0xf	C++
 	inspector.dll!inDOMView::GetChildNodesFor(nsIDOMNode * aNode=0x02c662f4,
nsCOMArray<nsIDOMNode> & aResult={...})  Line 1149 + 0x9	C++
 	inspector.dll!inDOMView::ExpandNode(int aRow=1)  Line 986	C++
 	inspector.dll!inDOMView::ToggleOpenState(int index=1)  Line 532	C++
 	xpcom_core.dll!XPTC_InvokeByIndex(nsISupports * that=0x038774ec, unsigned int
methodIndex=24, unsigned int paramCount=1, nsXPTCVariant * params=0x0012c964)
 Line 102	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...},
XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2065 + 0x1e	C++
 	xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x0376bad8, JSObject *
obj=0x02cb2c88, unsigned int argc=1, long * argv=0x03b96db8, long *
vp=0x0012cc38)  Line 1287 + 0xe	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x0376bad8, unsigned int argc=1, unsigned
int flags=0)  Line 1320 + 0x20	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0376bad8, unsigned char *
pc=0x03296a5c, long * result=0x0012d724)  Line 3610 + 0xf	C
 	js3250.dll!js_Invoke(JSContext * cx=0x0376bad8, unsigned int argc=1, unsigned
int flags=0)  Line 1340 + 0x13	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0376bad8, unsigned char *
pc=0x035aad04, long * result=0x0012e18c)  Line 3610 + 0xf	C
 	js3250.dll!js_Invoke(JSContext * cx=0x0376bad8, unsigned int argc=1, unsigned
int flags=2)  Line 1340 + 0x13	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x0376bad8, JSObject *
obj=0x02cb27b0, long fval=54499032, unsigned int flags=0, unsigned int argc=1,
long * argv=0x0012e408, long * rval=0x0012e410)  Line 1417 + 0x14	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x0376bad8, JSObject *
obj=0x02cb27b0, long fval=54499032, unsigned int argc=1, long * argv=0x0012e408,
long * rval=0x0012e410)  Line 3851 + 0x1f	C
 	gklayout.dll!nsJSContext::CallEventHandler(JSObject * aTarget=0x02cb27b0,
JSObject * aHandler=0x033f96d8, unsigned int argc=1, long * argv=0x0012e408,
long * rval=0x0012e410)  Line 1385 + 0x21	C++
 	gklayout.dll!nsJSEventListener::HandleEvent(nsIDOMEvent * aEvent=0x039193f8) 
Line 175 + 0x2b	C++
 	gklayout.dll!nsXBLPrototypeHandler::ExecuteHandler(nsIDOMEventReceiver *
aReceiver=0x039447f0, nsIDOMEvent * aEvent=0x039193f8)  Line 494	C++
 	gklayout.dll!nsXBLEventHandler::HandleEvent(nsIDOMEvent * aEvent=0x039193f8) 
Line 85	C++
 	gklayout.dll!nsEventListenerManager::HandleEventSubType(nsListenerStruct *
aListenerStruct=0x0388e110, nsIDOMEvent * aDOMEvent=0x039193f8,
nsIDOMEventTarget * aCurrentTarget=0x039447f0, unsigned int aSubType=4, unsigned
int aPhaseFlags=7)  Line 1568 + 0x14	C++
 	gklayout.dll!nsEventListenerManager::HandleEvent(nsPresContext *
aPresContext=0x03855a78, nsEvent * aEvent=0x0012efec, nsIDOMEvent * *
aDOMEvent=0x0012ee80, nsIDOMEventTarget * aCurrentTarget=0x039447f0, unsigned
int aFlags=7, nsEventStatus * aEventStatus=0x0012f518)  Line 1672	C++
 	gklayout.dll!nsXULElement::HandleDOMEvent(nsPresContext *
aPresContext=0x03855a78, nsEvent * aEvent=0x0012efec, nsIDOMEvent * *
aDOMEvent=0x0012ee80, unsigned int aFlags=7, nsEventStatus *
aEventStatus=0x0012f518)  Line 2194	C++
 	gklayout.dll!PresShell::HandleEventInternal(nsEvent * aEvent=0x0012efec,
nsIView * aView=0x00000000, unsigned int aFlags=1, nsEventStatus *
aStatus=0x0012f518)  Line 6320 + 0x3a	C++
 	gklayout.dll!PresShell::HandleEventWithTarget(nsEvent * aEvent=0x0012efec,
nsIFrame * aFrame=0x03887cc0, nsIContent * aContent=0x038613d0, unsigned int
aFlags=1, nsEventStatus * aStatus=0x0012f518)  Line 6224 + 0x16	C++
 	gklayout.dll!nsEventStateManager::CheckForAndDispatchClick(nsPresContext *
aPresContext=0x03855a78, nsMouseEvent * aEvent=0x0012f780, nsEventStatus *
aStatus=0x0012f518)  Line 2923 + 0x42	C++
 	gklayout.dll!nsEventStateManager::PostHandleEvent(nsPresContext *
aPresContext=0x03855a78, nsEvent * aEvent=0x0012f780, nsIFrame *
aTargetFrame=0x03887cc0, nsEventStatus * aStatus=0x0012f518, nsIView *
aView=0x038907b8)  Line 1954 + 0x17	C++
 	gklayout.dll!PresShell::HandleEventInternal(nsEvent * aEvent=0x0012f780,
nsIView * aView=0x038907b8, unsigned int aFlags=1, nsEventStatus *
aStatus=0x0012f518)  Line 6391 + 0x3d	C++
 	gklayout.dll!PresShell::HandleEvent(nsIView * aView=0x038907b8, nsGUIEvent *
aEvent=0x0012f780, nsEventStatus * aEventStatus=0x0012f518, int aForceHandle=0,
int & aHandled=1)  Line 6163 + 0x19	C++
 	gklayout.dll!nsViewManager::HandleEvent(nsView * aView=0x038907b8, nsGUIEvent
* aEvent=0x0012f780, int aCaptured=0)  Line 2502	C++
 	gklayout.dll!nsViewManager::DispatchEvent(nsGUIEvent * aEvent=0x0012f780,
nsEventStatus * aStatus=0x0012f65c)  Line 2224 + 0x14	C++
 	gklayout.dll!HandleEvent(nsGUIEvent * aEvent=0x0012f780)  Line 174	C++
 	gkwidget.dll!nsWindow::DispatchEvent(nsGUIEvent * event=0x0012f780,
nsEventStatus & aStatus=nsEventStatus_eIgnore)  Line 1927 + 0xa	C++
 	gkwidget.dll!nsWindow::DispatchWindowEvent(nsGUIEvent * event=0x0012f780) 
Line 1948	C++
 	gkwidget.dll!nsWindow::DispatchMouseEvent(unsigned int aEventType=301,
unsigned int wParam=0, nsPoint * aPoint=0x00000000)  Line 6673 + 0x15	C++
 	gkwidget.dll!ChildWindow::DispatchMouseEvent(unsigned int aEventType=301,
unsigned int wParam=0, nsPoint * aPoint=0x00000000)  Line 6928	C++
 	gkwidget.dll!nsWindow::ProcessMessage(unsigned int msg=514, unsigned int
wParam=0, long lParam=1703958, long * aRetValue=0x0012fc7c)  Line 5323 + 0x1c	C++
 	gkwidget.dll!nsWindow::WindowProc(HWND__ * hWnd=0x001206a8, unsigned int
msg=514, unsigned int wParam=0, long lParam=1703958)  Line 2219 + 0x1b	C++
 	user32.dll!_InternalCallWinProc@20()  + 0x28	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7	
 	user32.dll!_DispatchMessageWorker@8()  + 0xdc	
 	user32.dll!_DispatchMessageW@4()  + 0xf	
 	gkwidget.dll!nsAppShell::Run()  Line 135	C++
 	appcomps.dll!nsAppStartup::Run()  Line 208	C++
 	mozilla.exe!main1(int argc=1, char * * argv=0x002f5460, nsISupports *
nativeApp=0x00bdcec0)  Line 1272 + 0x20	C++
 	mozilla.exe!main(int argc=1, char * * argv=0x002f5460)  Line 1763 + 0x25	C++
 	mozilla.exe!mainCRTStartup()  Line 398 + 0x11	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23	

The problem occurs in inLayoutUtils::GetBindingManagerFor ()
nsCOMPtr<nsIDocument> doc = do_QueryInterface(domdoc);
returns NULL doc and in next line call to BindingManager () with this invalid
doc causes access violation error.

Seems that this in not duplicate of bug 253354.
Trunk build of 7 May, 2005

Comment 1

[Dainis Jonitis]

I compiled the Mozilla today (2005-05-17) and I can't reproduce the crash anymore. 
Now owner document for incoming nsIDOMNode is nsIDOMDocument that also
implements nsXULDocument, nsXMLDocument, nsDocument and finally nsIDocument and
as result do_QueryInterface returns correct doc.

Not sure which checkin in the last week fixed it. Closing as FIXED.