335083 - crash while saving images [@ _handle_union] from nsFileView::FilterFiles

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Rahul Pardeshi]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

whenever i try to save any image by right clicking and clicking on "Save image as", firefox crashes. :(

Reproducible: Always

Steps to Reproduce:
1.open any web page with images
2.right click on the image and click on save image as...
3.see the browser crash

Actual Results:  
the browser crashes

Expected Results:  
should have given a popup window to ask location to save to

Comment 1

[Martijn Wargers (dead)]

Could you give a talkback ID of the crash?
http://kb.mozillazine.org/Talkback

Comment 2

[Paolo Amoroso]

(In reply to comment #1)
> Could you give a talkback ID of the crash?
> http://kb.mozillazine.org/Talkback

I am not the original submitter, but I can reproduce the bug. Here is a Talkback ID: TB19981591G

Comment 3

[Martijn Wargers (dead)]

From talkback ID:
_handle_union()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpfe/components/filepicker/src/nsWildCard.cpp, line 156]
_shexp_match()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpfe/components/filepicker/src/nsWildCard.cpp, line 202]
NS_WildCardMatch()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpfe/components/filepicker/src/nsWildCard.cpp, line 288]
nsFileView::FilterFiles()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpfe/components/filepicker/src/nsFileView.cpp, line 119]
nsFileView::SetDirectory()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpfe/components/filepicker/src/nsFileView.cpp, line 287]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2151]
XPC_WN_CallMethod()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1445]
js_Invoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1188]
js_Interpret()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 3584]
js_Invoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1208]
js_InternalInvoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1286]
JS_CallFunctionValue()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsapi.c, line 4172]
nsJSContext::CallEventHandler()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1413]
nsGlobalWindow::RunTimeout()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 848]
nsGlobalWindow::TimerCallback()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 6749]
nsTimerImpl::Fire()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 395]
handleTimerEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp, line 462]
PL_HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpcom/threads/plevent.c, line 689]
PL_ProcessPendingEvents()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpcom/threads/plevent.c, line 623]
nsEventQueueImpl::ProcessPendingEvents()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpcom/threads/nsEventQueue.cpp, line 421]
event_processor_callback()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 67]
libglib-2.0.so.0 + 0x4955f (0x4061c55f)
libglib-2.0.so.0 + 0x23f72 (0x405f6f72)
libglib-2.0.so.0 + 0x25048 (0x405f8048)
libglib-2.0.so.0 + 0x25380 (0x405f8380)
libglib-2.0.so.0 + 0x255ed (0x405f85ed)
nsAppShell::DispatchNativeEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 276]
nsXULWindow::ShowModal()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpfe/appshell/src/nsXULWindow.cpp, line 848]
nsContentTreeOwner::ShowAsModal()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp, line 431]
nsWindowWatcher::OpenWindowJS()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp, line 848]
nsGlobalWindow::OpenInternal()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 848]
nsGlobalWindow::OpenDialog()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp, line 4429]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2151]
XPC_WN_CallMethod()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1445]
js_Invoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1188]
js_Interpret()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 3584]
js_Invoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1208]
nsXPCWrappedJSClass::CallMethod()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp, line 1373]
nsXPCWrappedJS::CallMethod()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp, line 462]
PrepareAndDispatch()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp, line 100]
XPTC_InvokeByIndex()
XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 2151]
XPC_WN_CallMethod()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp, line 1445]
js_Invoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1188]
js_Interpret()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 3584]
js_Invoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1208]
js_Interpret()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 3584]
js_Invoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1208]
js_InternalInvoke()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsinterp.c, line 1286]
JS_CallFunctionValue()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/js/src/jsapi.c, line 4172]
nsJSContext::CallEventHandler()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1413]
nsJSEventListener::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/dom/src/events/nsJSEventListener.cpp, line 185]
nsEventListenerManager::HandleEventSubType()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 848]
nsEventListenerManager::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/content/events/src/nsEventListenerManager.cpp, line 1786]
nsXULElement::HandleDOMEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/content/xul/content/src/nsXULElement.cpp, line 2139]
PresShell::HandleDOMEventWithTarget()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 6474]
nsMenuFrame::Execute()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 848]
nsMenuFrame::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp, line 454]
PresShell::HandleEventInternal()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 6419]
PresShell::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/layout/base/nsPresShell.cpp, line 6214]
nsViewManager::HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/view/src/nsViewManager.cpp, line 848]
nsViewManager::DispatchEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/view/src/nsViewManager.cpp, line 2246]
HandleEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/view/src/nsView.cpp, line 251]
nsCommonWidget::DispatchEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/widget/src/gtk2/nsCommonWidget.cpp, line 219]
nsWindow::OnButtonReleaseEvent()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 1600]
button_release_event_cb()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/widget/src/gtk2/nsWindow.cpp, line 3737]
libgtk-x11-2.0.so.0 + 0x112714 (0x402fb714)
libgobject-2.0.so.0 + 0x92c0 (0x4059e2c0)
libgobject-2.0.so.0 + 0x1d2c5 (0x405b22c5)
libgobject-2.0.so.0 + 0x1c07e (0x405b107e)
libgobject-2.0.so.0 + 0x1c5a4 (0x405b15a4)
libgtk-x11-2.0.so.0 + 0x2115f7 (0x403fa5f7)
libgtk-x11-2.0.so.0 + 0x110cb2 (0x402f9cb2)
libgtk-x11-2.0.so.0 + 0x10fa06 (0x402f8a06)
libgdk-x11-2.0.so.0 + 0x3e985 (0x404ee985)
libglib-2.0.so.0 + 0x23f72 (0x405f6f72)
libglib-2.0.so.0 + 0x25048 (0x405f8048)
libglib-2.0.so.0 + 0x25380 (0x405f8380)
libglib-2.0.so.0 + 0x259c3 (0x405f89c3)
libgtk-x11-2.0.so.0 + 0x10f2c3 (0x402f82c3)
nsAppShell::Run()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/widget/src/gtk2/nsAppShell.cpp, line 141]
nsAppStartup::Run()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp, line 151]
XRE_main()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/toolkit/xre/nsAppRunner.cpp, line 2376]
main()  [/builds/tinderbox/Fx-Mozilla1.8.0-Release/Linux_2.4.21-37.EL_Depend/mozilla/browser/app/nsBrowserApp.cpp, line 62]
libc.so.6 + 0x15936 (0x409f5936)

Comment 4

[timeless]

not quite sure why it's crashing.
the alloc isn't null checked which isn't a good start.

Comment 5

[Caio Tiago Oliveira (asrail)]

Is this bug still happening?

Comment 6

[Paolo Amoroso]

(In reply to comment #5)
> Is this bug still happening?

It still happens in Firefox 1.5.0.9 for Linux.

Comment 7

[Nickolay_Ponomarev]

I thought we started using the native filepicker at one moment, so this code shouldn't be triggered in newer builds...

Comment 8

[timeless]

that depends on whether you have a new enough non sucky version of gtk.

Comment 9

[Rahul Pardeshi]

hi the problem is not seen on firefox 3.0.1

Comment 10

[timeless]

fwiw, my guess is that the crash was for input like:

"(", where the code just searched for a ) that wasn't present. not certain, but it seems likely. afaict the code no longer exists on trunk, but it should still crash on the 1.8 branch....