341666 - Crash in [@ nsJSContext::ConvertSupportsTojsvals] invoking Download Manager.

Status: VERIFIED DUPLICATE of bug 342219

(Core :: DOM: Core & HTML, defect)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Build ID: 2006-06-15-09, Windows XP SeaMonkey trunk.

Summary: Crash in [@ nsJSContext::ConvertSupportsTojsvals] invoking Download Manager.

This is a regression from bug 255942.

Steps to Reproduce:

1. In a SeaMonkey trunk build, go to Tools | Download Manager

Expected Results:

Download Manager is invoked.

Actual Results:

We crash in nsJSContext::ConvertSupportsTojsvals, with what looks like a null wrapper.

According to talkback, we crash in line 2194:

2192                             if (NS_SUCCEEDED(rv)) {
2193                               JSObject *obj;
2194                               rv = wrapper->GetJSObject(&obj);
2195                               if (NS_SUCCEEDED(rv)) {
2196                                 *thisval = OBJECT_TO_JSVAL(obj);

I'll attach the full stack to allow this bug to be cleaner.

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Full crash stack.

Comment 2

[Samuel Sieb]

I get it on Linux Seamonkey trunk.

Comment 3

[timeless]

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/xpconnect/src/xpcconvert.cpp&rev=1.101&mark=1024-1025,1022-1023#1009
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/dom/src/base/nsDOMClassInfo.cpp&rev=1.391&mark=1452,1454,1457#1437
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/xpconnect/src/nsXPConnect.cpp&rev=1.84&mark=567,570#547
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/dom/src/base/nsJSEnvironment.cpp&rev=1.284&mark=2121,2189,2194#2173

there are two bugs here.
#1. xpconnect has always buggily returned an undefined result if you passed a null thing to wrap.
#2. mark didn't null check the thing he was wrapping.

I'll fix 1 if someone doesn't beat me to it, but mark needs to figure out 2 since he's the one who caused the crash :).

Comment 4

[Boris Zbarsky [:bzbarsky]]

Duping forward to bug with more data.... :(

*** This bug has been marked as a duplicate of 342219 ***

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified DUP; I only care that the bug gets fixed, which it's taking a long time to do so ;-(