33224 - JavaScript bookmarklets which load a URL crash with memory corruption

Status: VERIFIED FIXED

(SeaMonkey :: Bookmarks & History, defect, P3)

Description

[Simon Fraser [no longer active]]

I can't use JS bookmarklets any more. For example, I have this one in my personal 
toolbar folder:

javascript:if(sint0002 = prompt('Bug Number:','')) location.href="http://
bugzilla.mozilla.org/show_bug.cgi?id=" + sint0002;

When I use this from the personal toolbar, or the bookmarks menu, I get this 
error:

If you visit this page with another browser and don't see a similar error, it may 
indicate that the site has not yet been updated to support standards implemented 
by the Mozilla browser such as the W3C Document Object Model (DOM).  Please see 
http://developer.netscape.com/mozilla/ for more information.
JavaScript Error: access disallowed from scripts at javascript:if(sint0002 = 
prompt('Bug Number:','')) location.href="http://bugzilla.mozilla.org/
show_bug.cgi?id=" + sint0002; to documents at another domain

Comment 1

[Robert John Churchill]

Warren fixed this a few weeks ago... so marking FIXED.

Comment 2

[Claudius Gayle]

my js bookmarklet doesn't work in the 2000051609 build

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Claudius..what's your bookmarklet, and what page were you looking at when you 
tried to run it?

Comment 4

[Claudius Gayle]

create a bookmark in your personal toolbar folder  e.g. javascript: alert('Hello World'); 
click link. JS console reports error line 0.

I had to create this with an older build as today's didn't seem to want to create bookmarksfor me (wrote bug) and then launch 
that same profile with today's build. My start page was Netscape's home page. i clicked the link and got no love.

Comment 5

[Chris McAfee]

back to rjc, slamm's on sabbatical

Comment 6

[Simon Fraser [no longer active]]

They kinda work for me now, but I'm crashing with memory corruption just after 
dismissing the prompt dialog: bug 45713

Comment 7

[Robert John Churchill]

Warren, you were messing around with this last (in Necko)... care to take a 
look-see?  Do JS bookmarklets work for you?

Comment 8

[Warren Harris]

I didn't check anything in last night. All that rdf stuff is still in my tree.

Comment 9

[Robert John Churchill]

Warren, I'm not talking about the optimization diffs that you just did.  I think 
that this JS bookmarklets problem has been around for awhile... and the last 
person to deal with it was you when you made some changes to Necko regarding 
when javascript: URLs get executed.  Care to take another look?

Comment 10

[Warren Harris]

What is a bookmarklet?

Comment 11

[Robert John Churchill]

Just a javascript: URL which has been bookmarked.  :^)

Comment 12

[Simon Fraser [no longer active]]

Sample bookmarklet in URL.

Note that these do now work, but I crash because of a double delete just after 
dismissing the prompt() dialog.

Comment 13

[Robert John Churchill]

Here's a stack trace on Win98:

_free_dbg_lk(void * 0x030d61c4, int 1) line 1017 + 82 bytes
_free_dbg(void * 0x030d61c4, int 1) line 970 + 13 bytes
free(void * 0x030d61c4) line 926 + 11 bytes
PR_Free(void * 0x030d61c4) line 66 + 10 bytes
IL_ReleaseColorSpace(_NI_ColorSpace * 0x03948f80) line 454 + 22 bytes
il_delete_container(il_container_struct * 0x0394e650) line 631 + 15 bytes
IL_NetRequestDone(il_container_struct * 0x0394e650, ilIURL * 0x0394e4c0, int 
-201) line 1186 + 9 bytes
NetReaderImpl::NetRequestDone(NetReaderImpl * const 0x0394df20, ilIURL * 
0x0394e4c0, int -201) line 141 + 20 bytes
ImageConsumer::OnStopRequest(ImageConsumer * const 0x039481c0, nsIChannel * 
0x0394c220, nsISupports * 0x00000000, unsigned int 2147500037, const unsigned 
short * 0x00000000) line 545
nsDocumentOpenInfo::OnStopRequest(nsDocumentOpenInfo * const 0x0394c0c0, 
nsIChannel * 0x0394c220, nsISupports * 0x00000000, unsigned int 2147500037, 
const unsigned short * 0x00000000) line 269
nsResChannel::EndRequest(unsigned int 2147500037, const unsigned short * 
0x00000000) line 706 + 50 bytes
nsResChannel::AsyncRead(nsResChannel * const 0x0394c220, nsIStreamListener * 
0x0394c0c0, nsISupports * 0x00000000) line 414
nsResChannel::OnStopRequest(nsResChannel * const 0x0394c224, nsIChannel * 
0x0394bc20, nsISupports * 0x00000000, unsigned int 2147500036, const unsigned 
short * 0x00000000) line 692 + 43 bytes
nsFileChannel::OnStopRequest(nsFileChannel * const 0x0394bc28, nsIChannel * 
0x0394bb60, nsISupports * 0x00000000, unsigned int 2147500036, const unsigned 
short * 0x00000000) line 632 + 45 bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x03a2d670) line 
302
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x03a2d620) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x03a2d620) line 587 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x014fd2e0) line 528 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0000096c, unsigned int 57786, unsigned int 0, 
long 22008544) line 1043 + 9 bytes
KERNEL32! bff7363b()
KERNEL32! bff94407()
00788a16()

If I try a javascript: that doesn't bring up another dialog (i.e. doesn't use 
JS's prompt/confirm/alert), everything seems OK... no crash.

Poking around through memory a bit, it looks like it might be some problem with 
the throbber image(s).

Comment 14

[Simon Fraser [no longer active]]

rjc is seeing the same crash that I was. However, THIS IS A DOUBLE DELETE BUG. 
Don't pay attention to the stack, but you'll have to trace what gets clobbered 
with watchpoints. Unfortunately, when I tried to do that, something else got 
clobbered.

Comment 15

[Warren Harris]

Purify's your friend. (Or it looks like it's _my_ friend -- why do I own this 
bug?)

Comment 16

[Simon Fraser [no longer active]]

Well, this no longer crashes for me today. Either the memory corruption has 
moved, or it was fixed.

Comment 17

[Simon Fraser [no longer active]]

These still crash.

Comment 18

[Simon Fraser [no longer active]]

Actually, teh crash is covered by 45713 so I'm closing this.

Comment 19

[Claudius Gayle]

VERIFIED Fixed for me with 2000113004 builds