366818 - crash [@ nsDOMConstructor::HasInstance ]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[:Mook]

(See URL)

I've somehow gotten in nsDOMConstructor::HasInstance where neither line 4991 nor line 4994 is true, therefore ci_data remains null.  I then crash on line 5008 due to an access violation.

Unfortunately, my steps to reproduce consist of:
1) Get Firefox trunk
2) Get Firebug 1.0b
3) Go to a page (I used slashdot)
4) Open firebug and click around (usually when going from the console view to the HTML view).

I'll try crashing again and see what name_struct->mType is.

Comment 1

[:Mook]

Attachment: stack at crash

Some random relevant-looking variables I found in the debugger:

name_struct->mType = eTypeProperty
dom_class.name = "InstallTrigger"
class_iid = {a6cf906b-15b3-11d2-932e-00805f8add32} = nsIDOMWindow

stack looks big, see attachment.  Bugzilla will want to wrap it anyway.

I still think that, at minimum, some sort of early bail-out would be nice (so at least I don't crash).

Comment 2

[Peter Van der Beken [:peterv]]

Attachment: v1

I think eTypeProperty is the only one that can trigger this, but this is more bulletproof. We could try to get the interfaces from the object's classinfo, but that doesn't seem worth it for such an edge-case.

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 251530 [details] [diff] [review]
v1

r+sr=jst

Comment 4

[Peter Van der Beken [:peterv]]

Comment on attachment 251530 [details] [diff] [review]
v1

Trivial crash fix.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 251530 [details] [diff] [review]
v1

approved for 1.8/1.8.0 branches, a=dveditz for drivers

Comment 6

[Marcia Knous [:marcia]]

verified fixed on the 1.8 branch using  Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4pre) Gecko/2007050804 BonEcho/2.0.0.4pre. Installed Firebug and clicked around on slashdot as described in original report, no crash observed. Adding branch verified keyword.

Comment 7

[Carsten Book [:Tomcat]]

verified fixed 1.8.0.12 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.12pre) Gecko/20070508 Firefox/1.5.0.12pre and the steps to reproduce from comment #0. No crash with Firebug on slashdot. Adding verified keyword.