342219 - Crash starting Download Manager from Tools menu [@ nsXPConnect::WrapNative] [@ nsJSContext::ConvertSupportsTojsvals]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Alan Smedley]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060620 SeaMonkey/1.5a
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060620 SeaMonkey/1.5a

In the current nightly build selecting Tools > Download Manager causes a crash in Seamonkey

The Seamon~1.EXE Application Error reads:

The instruction at "0x603fc2e2" referenced memory at "0x00000000". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

The Netscape Quality Feedback Agent - Mozella Trunk is then run and it sends back a report if I tell it to, which I always do.


Reproducible: Always

Steps to Reproduce:
1. Select Tool Menu
2. Select Download Manager
3. Brings up Seamon~1.EXE Application Error

Actual Results:  
The Seamon~1.EXE Application Error reads:

The instruction at "0x603fc2e2" referenced memory at "0x00000000". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

The Netscape Quality Feedback Agent - Mozella Trunk is then run

Expected Results:  
Download Manager should run as expected.  It runs when a download is selected from a web page.

Comment 1

[Andrew Schultz]

Attachment: stacktrace

(gdb) frame 6
#6  0x0060985b in nsXPConnect::WrapNative (this=0xa057038, aJSContext=0xa691228, aScope=0xa6de578, aCOMObj=0x0, aIID=@0x69ffdb8, _retval=0xbf964828)
    at /build/andrew/moz-debug/mozilla/js/src/xpconnect/src/nsXPConnect.cpp:578
578         (*_retval)->GetJSObject(&returnObj);
(gdb) p _retval
$1 = (class nsIXPConnectJSObjectHolder **) 0xbf964828
(gdb) p *_retval
$2 = (class nsIXPConnectJSObjectHolder *) 0x0

Comment 2

[Andrew Schultz]

I'm seeing this with linux seamonkey trunk 2006062008.

A debug build also asserts (2 of each)

###!!! ASSERTION: Array elt doesn't have nsISupports?: 'NS_SUCCEEDED(rv)', file /build/andrew/moz-debug/mozilla/dom/src/base/nsJSEnvironment.cpp, line 2175
###!!! ASSERTION: Empty arg: 'aArg', file /build/andrew/moz-debug/mozilla/dom/src/base/nsJSEnvironment.cpp, line 2231
###!!! ASSERTION: bad param: 'aCOMObj', file /build/andrew/moz-debug/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 561

==> Download manager for now

Comment 3

[Andrew Schultz]

This regressed between linux seamonkey trunk builds 2006061409 and 2006061508, perhaps bug 337095?

Comment 4

[Andrew Schultz]

this shows up in talkback as nsJSContext::ConvertSupportsTojsvals

Comment 5

[Boris Zbarsky [:bzbarsky]]

No, this is a "regression" from bug 341362.  Or rather the code in nsJSContext::ConvertSupportsTojsvals that was added for bug 255942 is bogus.

What happens in this case is that tasksOverlay.js does:

 62     dlmgr.open(window, null);

Then we get to:

677 nsDownloadManager::Open(nsIDOMWindow* aParent, nsIDownload* aDownload)

which does:

689   nsCOMPtr<nsISupports> dlSupports(do_QueryInterface(aDownload));
...
709   params->AppendElement(dlSupports);

and passes |params| to nsIWindowWatcher::OpenWindow.  This code _used_ to convert (in nsWindowWatcher::AddSupportsTojsvals) a null nsISupports* into JSVAL_NULL.  Now (in nsJSContext::ConvertSupportsTojsvals) it asserts a couple times and then crashes, as observed in this bug.

I see nothing in the window watcher API that prevents passing an array containing nulls in it as the arguments array; when that happens we should deal appropriately (convert them to JSVAL_NULL).

Comment 6

[Boris Zbarsky [:bzbarsky]]

*** Bug 341666 has been marked as a duplicate of this bug. ***

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Obvious patch

So, it seems like this should fix things?

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 226509 [details] [diff] [review]
Obvious patch

Looks ok (please do test!), but there's no reason to assign rv from QueryElementAt now...  So take that part out.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked in with Boris' comment addressed.

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using build 2006-06-21-16 of SeaMonkey trunk on Windows XP; I can now open the Download Manager without crashing.