Closed Bug 323331 Opened 19 years ago Closed 6 years ago

nsXBLProtoImpl::CompilePrototypeMembers doesn't NS_ENSURE_TRUE(global, NS_ERROR_OUT_OF_MEMORY) instead it passes it to spider monkey which crashes [@ JS_LookupPropertyWithFlags]

Categories

(Core :: XUL, defect)

Product:
Core
Component:
XUL
Version:
1.8 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: timeless, Unassigned)

Details

(Keywords: crash)

Crash Data

00 js3250!JS_LookupPropertyWithFlags(struct JSContext * cx = 0x07d040f8, struct JSObject * obj = 0x00000000, char * name = 0x07b95de0 "chrome://global/content/bindings/scrollbox.xml#arrowscrollbox", unsigned int flags = 0x10, long * vp = 0x0012ea0c)+0x28 [c:\build\chs3.1\build\mozilla\js\src\jsapi.c @ 2707] 01 gklayout!nsXBLBinding::DoInitJSClass(struct JSContext * cx = 0x07d040f8, struct JSObject * global = 0x00000000, struct JSObject * obj = 0x00000000, class nsCString * aClassName = 0x07e1f2b0, void ** aClassObject = 0x0012ea60)+0x98 [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblbinding.cpp @ 1031] 02 gklayout!nsXBLPrototypeBinding::InitClass(class nsCString * aClassName = 0x07e1f2b0, struct JSContext * aContext = 0x07d040f8, struct JSObject * aGlobal = 0x00000000, struct JSObject * aScriptObject = 0x00000000, void ** aClassObject = 0x0012ea60)+0x26 [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblprototypebinding.cpp @ 746] 03 gklayout!nsXBLProtoImpl::CompilePrototypeMembers(class nsXBLPrototypeBinding * aBinding = 0x07b52eb8)+0x63 [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblprotoimpl.cpp @ 183] 04 gklayout!nsXBLProtoImpl::InitTargetObjects(class nsXBLPrototypeBinding * aBinding = 0x07b52eb8, class nsIScriptContext * aContext = 0x01b03858, class nsIContent * aBoundElement = 0x03021280, class nsIXPConnectJSObjectHolder ** aScriptObjectHolder = 0x0012eac8, void ** aTargetClassObject = 0x0012eac0)+0x27 [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblprotoimpl.cpp @ 110] 05 gklayout!nsXBLProtoImpl::InstallImplementation(class nsXBLPrototypeBinding * aBinding = 0x07b52eb8, class nsIContent * aBoundElement = 0x03021280)+0x6b [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblprotoimpl.cpp @ 82] 06 gklayout!nsXBLPrototypeBinding::InstallImplementation(class nsIContent * aBoundElement = 0x0148db6a)+0x13 [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblprototypebinding.cpp @ 442] 07 gklayout!nsXBLBinding::InstallImplementation(void)+0x29 [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblbinding.cpp @ 751] 08 gklayout!nsXBLService::LoadBindings(class nsIContent * aContent = 0x03021280, class nsIURI * aURL = 0x01abe590, int aAugmentFlag = 0, class nsXBLBinding ** aBinding = 0x0012eb70, int * aResolveStyle = 0x0012eb7c)+0x1d4 [c:\build\chs3.1\build\mozilla\content\xbl\src\nsxblservice.cpp @ 642] 09 gklayout!nsCSSFrameConstructor::ConstructFrameInternal(class nsFrameConstructorState * aState = 0x0012eff0, class nsIContent * aContent = 0x00fc69d8, class nsIFrame * aParentFrame = 0x078eb50c, class nsIAtom * aTag = 0x01abe4e8, int aNameSpaceID = 9, class nsStyleContext * aStyleContext = 0x078eb180, struct nsFrameItems * aFrameItems = 0x0012ee0c, int aXBLBaseTag = 0)+0x9e [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 7667] 0a gklayout!nsCSSFrameConstructor::ConstructFrame(class nsFrameConstructorState * aState = 0x0012eff0, class nsIContent * aContent = 0x00000000, class nsIFrame * aParentFrame = 0x078eb180, struct nsFrameItems * aFrameItems = 0x0012ee0c)+0xb2 [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 7624] 0b gklayout!nsCSSFrameConstructor::ProcessChildren(class nsFrameConstructorState * aState = 0x0012eff0, class nsIContent * aContent = 0x028e4a70, class nsIFrame * aFrame = 0x03021280, int aCanHaveGeneratedContent = 0, struct nsFrameItems * aFrameItems = 0x0012ee0c, int aParentIsBlock = 0, struct nsTableCreator * aTableCreator = 0x03021280)+0xcd [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 11977] 0c gklayout!nsCSSFrameConstructor::ConstructXULFrame(class nsFrameConstructorState * aState = 0x0012eff0, class nsIContent * aContent = 0x028e4a70, class nsIFrame * aParentFrame = 0x00000001, class nsIAtom * aTag = 0x00fb7480, int aNameSpaceID = 0, class nsStyleContext * aStyleContext = 0x078eb230, struct nsFrameItems * aFrameItems = 0x0012f0cc, int aXBLBaseTag = 0, int aHasPseudoParent = 0, int * aHaltProcessing = 0x078eb50c)+0x7d8 [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 6309] 0d gklayout!nsCSSFrameConstructor::ConstructFrameInternal(class nsFrameConstructorState * aState = 0x0012eff0, class nsIContent * aContent = 0x03009df8, class nsIFrame * aParentFrame = 0x00000000, class nsIAtom * aTag = 0x00fb7480, int aNameSpaceID = 9, class nsStyleContext * aStyleContext = 0x00000000, struct nsFrameItems * aFrameItems = 0x00000000, int aXBLBaseTag = 0)+0x255 [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 7741] 0e gklayout!nsCSSFrameConstructor::ConstructFrame(class nsFrameConstructorState * aState = 0x0012eff0, class nsIContent * aContent = 0x00000000, class nsIFrame * aParentFrame = 0x078eb230, struct nsFrameItems * aFrameItems = 0x0012f0cc)+0xb2 [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 7624] 0f gklayout!nsCSSFrameConstructor::ContentInserted(class nsIContent * aContainer = 0x0216d808, class nsIFrame * aContainerFrame = 0x03009df8, class nsIContent * aChild = 0x028e4a70, int aIndexInContainer = 1, class nsILayoutHistoryState * aFrameState = 0x00000000, int aInReinsertContent = 0)+0x45e [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 9368] 10 gklayout!nsCSSFrameConstructor::RecreateFramesForContent(class nsIContent * aContent = 0x00000000)+0x11e [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 11857] 11 gklayout!nsCSSFrameConstructor::MaybeRecreateFramesForContent(class nsIContent * aContent = 0x028e4a70)+0x5d [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 11758] 12 gklayout!nsCSSFrameConstructor::RestyleElement(class nsIContent * aContent = 0x028e4a70, class nsIFrame * aPrimaryFrame = 0x00000000, nsChangeHint aMinHint = 0 (No matching enumerant))+0xa0 [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 10407] 13 gklayout!nsCSSFrameConstructor::ProcessOneRestyle(class nsIContent * aContent = 0x00000000, nsReStyleHint aRestyleHint = eReStyle_Self (1), nsChangeHint aChangeHint = 0 (No matching enumerant))+0x51 [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 13812] 14 gklayout!nsCSSFrameConstructor::AttributeChanged(class nsIContent * aContent = 0x028e4a70, int aNameSpaceID = 28683744, class nsIAtom * aAttribute = 0x00000001, int aModType = 16479360)+0x240 [c:\build\chs3.1\build\mozilla\layout\base\nscssframeconstructor.cpp @ 10596] 15 gklayout!PresShell::AttributeChanged(class nsIDocument * aDocument = 0x02f98fd0, class nsIContent * aContent = 0x0074139b, int aNameSpaceID = 28683760, class nsIAtom * aAttribute = 0x030f24b4, int aModType = 42879600)+0x28 [c:\build\chs3.1\build\mozilla\layout\base\nspresshell.cpp @ 5435] 16 gklayout!nsXULDocument::AttributeChanged(class nsIContent * aElement = 0x00000001, int aNameSpaceID = 0, class nsIAtom * aAttribute = 0x00fb74b0, int aModType = 2)+0x1b4 [c:\build\chs3.1\build\mozilla\content\xul\document\src\nsxuldocument.cpp @ 1138] 17 gklayout!nsXULElement::SetAttrAndNotify(int aNamespaceID = 0, class nsIAtom * aAttribute = 0x00fb74b0, class nsIAtom * aPrefix = 0x00000000, class nsAString_internal * aOldValue = 0x0012f63c, class nsAttrValue * aParsedValue = 0x0012f6ec, int aModification = 33554432, int aFireMutation = 0, int aNotify = 1)+0x24c [c:\build\chs3.1\build\mozilla\content\xul\content\src\nsxulelement.cpp @ 1519] 18 gklayout!nsXULElement::SetAttr(int aNamespaceID = 0, class nsIAtom * aName = 0x00000000, class nsIAtom * aPrefix = 0x00000000, class nsAString_internal * aValue = 0x0012f7ac, int aNotify = 1)+0x1b3 [c:\build\chs3.1\build\mozilla\content\xul\content\src\nsxulelement.cpp @ 1440] 19 gklayout!nsMenuFrame::MarkAsGenerated(void)+0x8b [c:\build\chs3.1\build\mozilla\layout\xul\base\src\nsmenuframe.cpp @ 625] 1a gklayout!nsMenuBarFrame::SetCurrentMenuItem(class nsIMenuFrame * aMenuItem = 0x03009e60)+0x5b [c:\build\chs3.1\build\mozilla\layout\xul\base\src\nsmenubarframe.cpp @ 564] 1b gklayout!nsMenuFrame::HandleEvent(class nsPresContext * aPresContext = 0x01aa84f8, class nsGUIEvent * aEvent = 0x00000001, nsEventStatus * aEventStatus = 0x0012f954)+0x264 [c:\build\chs3.1\build\mozilla\layout\xul\base\src\nsmenuframe.cpp @ 498] 1c gklayout!PresShell::HandleEventInternal(class nsEvent * aEvent = 0x01ad25b8, class nsIView * aView = 0x01ad25b8, unsigned int aFlags = 1, nsEventStatus * aStatus = 0x0012f954)+0x2bb [c:\build\chs3.1\build\mozilla\layout\base\nspresshell.cpp @ 6410] 1d gklayout!PresShell::HandleEvent(class nsIView * aView = 0x01ad25b8, class nsGUIEvent * aEvent = 0x0012fa30, nsEventStatus * aEventStatus = 0x0012f954, int aForceHandle = 50372088, int * aHandled = 0x0216d808)+0x210 [c:\build\chs3.1\build\mozilla\layout\base\nspresshell.cpp @ 6203] 1e gklayout!nsViewManager::HandleEvent(class nsView * aView = 0x00000000, class nsGUIEvent * aEvent = 0x0012fa30, int aCaptured = 1)+0x206 [c:\build\chs3.1\build\mozilla\view\src\nsviewmanager.cpp @ 2559] 1f gklayout!nsViewManager::DispatchEvent(class nsGUIEvent * aEvent = 0x3d888889, nsEventStatus * aStatus = 0x0012f9dc)+0x63a [c:\build\chs3.1\build\mozilla\view\src\nsviewmanager.cpp @ 2246] 20 gklayout!HandleEvent(class nsGUIEvent * aEvent = 0x0012fa30)+0x27 [c:\build\chs3.1\build\mozilla\view\src\nsview.cpp @ 174] 21 gkwidget!nsWindow::DispatchEvent(class nsGUIEvent * event = 0x00000000, nsEventStatus * aStatus = 0x01a62e18)+0x35 [c:\build\chs3.1\build\mozilla\widget\src\windows\nswindow.cpp @ 1253] 22 gkwidget!nsWindow::DispatchWindowEvent(class nsGUIEvent * event = 0x00000000)+0x16 [c:\build\chs3.1\build\mozilla\widget\src\windows\nswindow.cpp @ 1274] 23 gkwidget!nsWindow::DispatchMouseEvent(unsigned int aEventType = 0x12c, unsigned int wParam = 0, struct nsPoint * aPoint = 0x00000000)+0x2e1 [c:\build\chs3.1\build\mozilla\widget\src\windows\nswindow.cpp @ 5992] 24 gkwidget!ChildWindow::DispatchMouseEvent(unsigned int aEventType = 0x17985cb, unsigned int wParam = 0x200, struct nsPoint * aPoint = 0x00000000)+0x61 [c:\build\chs3.1\build\mozilla\widget\src\windows\nswindow.cpp @ 6243] 25 gkwidget!nsWindow::ProcessMessage(unsigned int msg = 0x200, unsigned int wParam = 0, long lParam = 1, long * aRetValue = 0x0012fd60)+0xb8c [c:\build\chs3.1\build\mozilla\widget\src\windows\nswindow.cpp @ 4547] 26 gkwidget!nsWindow::WindowProc(struct HWND__ * hWnd = 0x00510228, unsigned int msg = 0x200, unsigned int wParam = 0, long lParam = 27667996)+0x9c [c:\build\chs3.1\build\mozilla\widget\src\windows\nswindow.cpp @ 1435] 27 USER32!UserCallWinProc+0x18 28 USER32!DispatchMessageWorker+0x2e4 29 USER32!DispatchMessageW+0xb 2a gkwidget!nsAppShell::Run(void)+0x10c [c:\build\chs3.1\build\mozilla\widget\src\windows\nsappshell.cpp @ 159] 2b appcomps!nsAppStartup::Run(void)+0xd [c:\build\chs3.1\build\mozilla\xpfe\components\startup\src\nsappstartup.cpp @ 208] 2c HsEngine!main1(int argc = 3, char ** argv = 0x002647d0, class nsISupports * nativeApp = 0x07f06610)+0x355 [c:\build\chs3.1\build\mozilla\xpfe\bootstrap\nsapprunner.cpp @ 1264] 2d HsEngine!main(int argc = 3, char ** argv = 0x002647d0)+0xc5 [c:\build\chs3.1\build\mozilla\xpfe\bootstrap\nsapprunner.cpp @ 1765] 2e HsEngine!WinMain(struct HINSTANCE__ * __formal = 0x7c59893d, struct HINSTANCE__ * __formal = 0x00000004, char * args = 0x00000008 "", int __formal = 2147348480)+0x18 [c:\build\chs3.1\build\mozilla\xpfe\bootstrap\nsapprunner.cpp @ 1789] 2f HsEngine!WinMainCRTStartup(void)+0x185 [f:\vs70builds\3077\vc\crtbld\crt\src\crtexe.c @ 390] 30 KERNEL32!BaseProcessStart+0x3d
internal reference: b1797-JS_LookupPropertyWithFlags-nsXBLProtoImpl-CompilePrototypeMembers_09F8_2006-01-13_11-36-02-046_0148 .cab
This isn't an XBL bug. nsIScriptGlobalObject promises a JSObject. Which one failed to produce one? It should have failed its Init() method instead.
At a guess, this is the XUL proto doc global... But it might be nsGlobalWindow
Assignee: general → nobody
Component: XBL → XP Toolkit/Widgets: XUL
QA Contact: ian → xptoolkit.xul
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
Crash Signature: [@ JS_LookupPropertyWithFlags]
JS_LookupPropertyWithFlags signature does not exist in current versions. But perhaps there is a match in the 3 most frequent (but still rare) signatures? https://crash-stats.mozilla.com/report/list?signature=JS_LookupPropertyWithFlagsById%28JSContext%2A%2C+JSObject%2A%2C+int%2C+unsigned+int%2C+JSObject%2A%2A%2C+JS%3A%3AValue%2A%29&product=Firefox&product=Thunderbird&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&date=2013-10-24+12%3A00%3A00&range_value=4#reports Crash Reports in JS_LookupPropertyWithFlagsById(JSContext*, JSObject*, int, unsigned int, JSObject**, JS::Value*) https://crash-stats.mozilla.com/report/list?signature=JS_LookupPropertyWithFlags%28JSContext%2A%2C+JSObject%2A%2C+char+const%2A%2C+unsigned+int%2C+JS%3A%3AValue%2A%29&product=Firefox&product=Thunderbird&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&date=2013-10-24+12%3A00%3A00&range_value=4#reports Crash Reports in JS_LookupPropertyWithFlags(JSContext*, JSObject*, char const*, unsigned int, JS::Value*) https://crash-stats.mozilla.com/report/list?signature=JS_LookupPropertyWithFlagsById%28JSContext%2A%2C+JSObject%2A%2C+int%2C+unsigned+int%2C+JSObject%2A%2A%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29&product=Firefox&product=Thunderbird&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&date=2013-10-24+12%3A00%3A00&range_value=4#reports Crash Reports in JS_LookupPropertyWithFlagsById(JSContext*, JSObject*, int, unsigned int, JSObject**, JS::MutableHandle<JS::Value>)
Crash Signature: [@ JS_LookupPropertyWithFlags] → [@ JS_LookupPropertyWithFlags ]
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.