409012 - Firefox - trunk build Version 3.0b3pre is crashing on AIX [@ strlen.strlen ] nsMozIconURI::GetIconState

Status: RESOLVED FIXED

(Core :: Graphics: ImageLib, defect)

Description

[Shailen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

Below is the stack trace for the core generated

Segmentation fault in . at 0x377c ($t1)
0x000000000000377c warning: Unable to access address 0x377c from core
(dbx) where
warning: Unable to access address 0x377c from core
warning: Unable to access address 0x377c from core
warning: Unable to access address 0x3778 from core
warning: Unable to access address 0x3778 from core
warning: Unable to access address 0x377c from core
warning: Unable to access address 0x377c from core
warning: Unable to access address 0x3778 from core
warning: Unable to access address 0x3778 from core
warning: Unable to access address 0x377c from core
.() at 0x377c
pthread_kill(??, ??) at 0x900000000252c14
_p_raise(??) at 0x900000000252648
unnamed block $b42120, line 206 in "nsProfileLock.cpp"
nsProfileLock::FatalSignalHandler(int)(signo = 11), line 206 in "nsProfileLock.cpp"
strlen.strlen() at 0x90000000001ba7c
nsCRTGlue.strlen(const char*)(0x600000000), line 111 in "string.h"
nsXPComInit.length(const char*)(0x600000000), line 611 in "nsCharTraits.h"
nsSubstring.Assign(const char*,unsigned int)(this = 0x0fffffffffff8800, data = warning: Unable to access address 0x600000000 from core
(invalid char ptr (0x0000000600000000)), length = 4294967295), line 336 in "nsTSubstring.cpp"
NS_CStringSetData_P(aStr = &(...), aData = warning: Unable to access address 0x600000000 from core
(invalid char ptr (0x0000000600000000)), aDataLength = 4294967295), line 311 in "nsXPCOMStrings.cpp"
NS_CStringSetData(aStr = &(...), aBuf = warning: Unable to access address 0x600000000 from core
(invalid char ptr (0x0000000600000000)), aCount = 4294967295), line 497 in "nsXPComStub.cpp"
nsIconURI.Assign(const char*,unsigned int)(0xfffffffffff8800, 0x600000000, 0xffffffffffffffff), line 414 in "nsStringAPI.h"
nsIconURI.operator=(const char*)(0xfffffffffff8800, 0x600000000), line 426 in "nsStringAPI.h"
nsMozIconURI::GetIconState(nsACString&)(this = 0x0000000110aad6b0, aState = &(...)), line 572 in "nsIconURI.cpp"
nsIconChannel::Init(nsIURI*)(this = 0x0000000110ad2130, aURI = 0x0000000110aad6b0), line 481 in "nsIconChannel.cpp"
nsIconProtocolHandler::NewChannel(nsIURI*,nsIChannel**)(this = 0x0000000110a11530, url = 0x0000000110aad6b0, result = 0x0fffffffffff8c70), line 115 in "nsIconProtocolHandler.cpp"
nsIOService::NewChannelFromURI(nsIURI*,nsIChannel**)(this = 0x000000011013aaf0, aURI = 0x0000000110aad6b0, result = 0x0fffffffffff8c70), line 571 in "nsIOService.cpp"
unnamed block $b32788, line 176 in "nsNetUtil.h"
imgLoader.NS_NewChannel(nsIChannel**,nsIURI*,nsIIOService*,nsILoadGroup*,nsIInterfaceRequestor*,unsigned int)(0xfffffffffff9100, 0x110aad6b0, 0x11013aaf0, 0x0, 0x11096b7d0, 0x0), line 176 in "nsNetUtil.h"
NewImageChannel(nsIChannel**,nsIURI*,nsIURI*,nsIURI*,nsILoadGroup*,unsigned int)(aResult = 0x0fffffffffff9100, aURI = 0x0000000110aad6b0, aInitialDocumentURI = 0x0000000110957e70, aReferringURI = 0x0000000110a94e90, aLoadGroup = 0x000000011096b5f0, aLoadFlags = 0), line 205 in "imgLoader.cpp"
unnamed block $b32811, line 468 in "imgLoader.cpp"
imgLoader::LoadImage(nsIURI*,nsIURI*,nsIURI*,nsILoadGroup*,imgIDecoderObserver*,nsISupports*,unsigned int,nsISupports*,imgIRequest*,imgIRequest**)(this = 0x0000000110326810, aURI = 0x0000000110aad6b0, aInitialDocumentURI = 0x0000000110957e70, aReferrerURI = 0x0000000110a94e90, aLoadGroup = 0x000000011096b5f0, aObserver = (nil), aCX = 0x00000001100c2e90, aLoadFlags = 0, cacheKey = (nil), aRequest = (nil), _retval = 0x0000000110aa7998), line 468 in "imgLoader.cpp"
nsContentUtils::LoadImage(nsIURI*,nsIDocument*,nsIPrincipal*,nsIURI*,imgIDecoderObserver*,int,imgIRequest**)(aURI = 0x0000000110aad6b0, aLoadingDocument = 0x00000001100c2e90, aLoadingPrincipal = 0x0000000110a96cd0, aReferrer = 0x0000000110a94e90, aObserver = (nil), aLoadFlags = 0, aRequest = 0x0000000110aa7998), line 2195 in "nsContentUtils.cpp"
nsCSSValue::Image::Image(nsIURI*,nsStringBuffer*,nsIURI*,nsIPrincipal*,nsIDocument*)(this = 0x0000000110aa7970, aURI = 0x0000000110aad6b0, aString = 0x0000000110aad750, aReferrer = 0x0000000110a94e90, aOriginPrincipal = 0x0000000110a96cd0, aDocument = 0x00000001100c2e90), line 473 in "nsCSSValue.cpp"
nsCSSValue::StartImageLoad(nsIDocument*) const(this = 0x0000000110aad8a8, aDocument = 0x00000001100c2e90), line 380 in "nsCSSValue.cpp"
unnamed block $b15014, line 212 in "nsCSSDataBlock.cpp"
unnamed block $b15013, line 212 in "nsCSSDataBlock.cpp"
unnamed block $b15012, line 212 in "nsCSSDataBlock.cpp"
unnamed block $b15011, line 212 in "nsCSSDataBlock.cpp"
nsCSSCompressedDataBlock::MapRuleInfoInto(nsRuleData*) const(this = 0x0000000110aad890, aRuleData = 0x0fffffffffff99a8), line 212 in "nsCSSDataBlock.cpp"
nsCSSDeclaration::MapRuleInfoInto(nsRuleData*) const(this = 0x0000000110aad650, aRuleData = 0x0fffffffffff99a8), line 94 in "nsCSSDeclaration.h"
CSSStyleRuleImpl::MapRuleInfoInto(nsRuleData*)(this = 0x0000000110aad8d0, aRuleData = 0x0fffffffffff99a8), line 1399 in "nsCSSStyleRule.cpp"
unnamed block $b15858, line 1369 in "nsRuleNode.cpp"
WalkRuleTree(nsStyleStructID,nsStyleContext*,nsRuleData*,nsCSSStruct*)(this = 0x0000000110aa63d0, aSID = eStyleStruct_List, aContext = 0x0000000110aa6488, aRuleData = 0x0fffffffffff99a8, aSpecificData = 0x0fffffffffff9938), line 1369 in "nsRuleNode.cpp"
GetListData(nsStyleContext*)(this = 0x0000000110aa63d0, aContext = 0x0000000110aa6488), line 1212 in "nsRuleNode.cpp"
GetStyleList(nsStyleContext*,int)(this = 0x0000000110aa63d0, aContext = 0x0000000110aa6488, aComputeData = 1), line 81 in "nsStyleStructList.h"
nsStyleContext::GetStyleList()(this = 0x0000000110aa6488), line 81 in "nsStyleStructList.h"
unnamed block $b15903, line 442 in "nsStyleContext.cpp"
unnamed block $b15902, line 442 in "nsStyleContext.cpp"
CalcStyleDifference(nsStyleContext*)(this = 0x0000000110aa5b50, aOther = 0x0000000110aa6488), line 442 in "nsStyleContext.cpp"
CaptureChange(nsStyleContext*,nsStyleContext*,nsIFrame*,nsIContent*,nsStyleChangeList*,nsChangeHint,nsChangeHint)(aOldContext = 0x0000000110aa5b50, aNewContext = 0x0000000110aa6488, aFrame = 0x0000000110aa60a8, aContent = 0x00000001109c3500, aChangeList = 0x0fffffffffffa778, aMinChange = nsChangeHint_RepaintFrame, aChangeToAssume = 0), line 1058 in "nsFrameManager.cpp"
unnamed block $b12383, line 1194 in "nsFrameManager.cpp"
unnamed block $b12380, line 1194 in "nsFrameManager.cpp"
nsFrameManager::ReResolveStyleContext(nsPresContext*,nsIFrame*,nsIContent*,nsStyleChangeList*,nsChangeHint)(this = 0x00000001109c7e68, aPresContext = 0x00000001109c62d0, aFrame = 0x0000000110aa60a8, aParentContent = 0x00000001109c3380, aChangeList = 0x0fffffffffffa778, aMinChange = nsChangeHint_RepaintFrame), line 1194 in "nsFrameManager.cpp"
unnamed block $b12393, line 1403 in "nsFrameManager.cpp"
unnamed block $b12392, line 1403 in "nsFrameManager.cpp"
unnamed block $b12380, line 1403 in "nsFrameManager.cpp"
nsFrameManager::ReResolveStyleContext(nsPresContext*,nsIFrame*,nsIContent*,nsStyleChangeList*,nsChangeHint)(this = 0x00000001109c7e68, aPresContext = 0x00000001109c62d0, aFrame = 0x0000000110aa5fa0, aParentContent = 0x00000001109c1858, aChangeList = 0x0fffffffffffa778, aMinChange = nsChangeHint_RepaintFrame), line 1403 in "nsFrameManager.cpp"
unnamed block $b12393, line 1403 in "nsFrameManager.cpp"
unnamed block $b12392, line 1403 in "nsFrameManager.cpp"
unnamed block $b12380, line 1403 in "nsFrameManager.cpp"
nsFrameManager::ReResolveStyleContext(nsPresContext*,nsIFrame*,nsIContent*,nsStyleChangeList*,nsChangeHint)(this = 0x00000001109c7e68, aPresContext = 0x00000001109c62d0, aFrame = 0x0000000110aa5f08, aParentContent = (nil), aChangeList = 0x0fffffffffffa778, aMinChange = nsChangeHint_RepaintFrame), line 1403 in "nsFrameManager.cpp"
unnamed block $b12396, line 1465 in "nsFrameManager.cpp"
nsFrameManager::ComputeStyleChangeFor(nsIFrame*,nsStyleChangeList*,nsChangeHint)(this = 0x00000001109c7e68, aFrame = 0x0000000110aa5f08, aChangeList = 0x0fffffffffffa778, aMinChange = nsChangeHint_RepaintFrame), line 1465 in "nsFrameManager.cpp"
unnamed block $b12011, line 10152 in "nsCSSFrameConstructor.cpp"
RestyleElement(nsIContent*,nsIFrame*,nsChangeHint)(this = 0x00000001109c95f0, aContent = 0x00000001109c1858, aPrimaryFrame = 0x0000000110aa5f08, aMinHint = nsChangeHint_RepaintFrame), line 10152 in "nsCSSFrameConstructor.cpp"
ProcessOneRestyle(nsIContent*,nsReStyleHint,nsChangeHint)(this = 0x00000001109c95f0, aContent = 0x00000001109c1858, aRestyleHint = eReStyle_Self, aChangeHint = nsChangeHint_RepaintFrame), line 13243 in "nsCSSFrameConstructor.cpp"
unnamed block $b12014, line 13296 in "nsCSSFrameConstructor.cpp"
ProcessPendingRestyles()(this = 0x00000001109c95f0), line 13296 in "nsCSSFrameConstructor.cpp"
PresShell::InitialReflow(int,int)(this = 0x00000001109c7e30, aWidth = 60, aHeight = 60), line 2413 in "nsPresShell.cpp"
unnamed block $b23995, line 1938 in "nsXULDocument.cpp"
nsXULDocument::StartLayout()(this = 0x00000001100c2e90), line 1938 in "nsXULDocument.cpp"
unnamed block $b24001, line 3076 in "nsXULDocument.cpp"
nsXULDocument::DoneWalking()(this = 0x00000001100c2e90), line 3076 in "nsXULDocument.cpp"
nsXULDocument::ResumeWalk()(this = 0x00000001100c2e90), line 3020 in "nsXULDocument.cpp"
nsXULDocument::OnStreamComplete(nsIStreamLoader*,nsISupports*,unsigned int,unsigned int,const unsigned char*)(this = 0x00000001100c2e90, aLoader = 0x00000001109e00f0, context = (nil), aStatus = 0, stringLen = 8350, string = "function closeWindow(aClose, aPromptFunction)\n{\n  var windowCount = 0;\n  var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"]\n                     .getService(Components.interfaces.nsIWindowMediator);\n  var e = wm.getEnumerator(null);\n  \n  while (e.hasMoreElements()) {\n    var w = e.getNext();\n    if (++windowCount == 2) \n      break;\n  }\n\n//@line 16 "/home/sjain/sb/tinderbox/AIX_5.2_Clobber/mozilla/toolkit/content/globalOverlay.js"\n  // If we're down to the last window and someone tries to shut down, check to make sure we can!\n  if (windowCount == 1 && !canQuitApplication())\n    return false;\n  else if (windowCount != 1)\n//@line 21 "/home/sjain/sb/tinderbox/AIX_5.2_Clobber/mozilla/toolkit/content/globalOverlay.js"\n    if (typeof(aPromptFunction) == "function" && !aPromptFunction())\n      return false;\n\n  if (aClose)    \n    window.close();\n  \n  return true;\n}\n\nfunction canQuitApplication()\n{\n  var os = Components.classes["@mozilla.org/observer-service;1"]\n                     .getService(Components.interfaces.nsIObserverService);\n  if (!os) return true;\n  \n  try {\n    var cancelQuit = Components.classes["@mozilla.org/supports-PRBool;1"]\n                              .createInstance(Components.interfaces.nsISupportsPRBool);\n    os.notifyObservers(cancelQuit, "quit-application-requested", null);\n    \n    // Something aborted the quit process. \n    if (cancelQuit.data)\n      return false;\n  }\n  catch (ex) { }\n  return true;\n}\n\nfunction goQuitApplication()\n{\n  if (!canQuitApplication())\n    return false;\n\n  var appStartup = Components.classes['@mozilla.org/toolkit/app-startup;1'].\n                     getService(Components.interfaces.nsIAppStartup);\n\n  appStartup.quit(Components.interfaces.nsIAppStartup.eAttemptQuit);\n  return true;\n}\n\n//\n// Command Updater functions\n//\nfunction goUpdateCommand(aCommand)\n{\n  try {\n    var controller = top.document.commandDispatcher\n                        .getControllerForCommand(aCommand);\n\n    var enabled = false;\n    if (controller)\n      enabled = controller.isCommandEnabled(aCommand);\n\n    goSetCommandEnabled(aCommand, enabled);\n  }\n  catch (e) {\n    dump("An error occurred updating the " + aCommand + " command\n");\n  }\n}\n\nfunction goDoCommand(aCommand)\n{\n  try {\n    var controller = top.document.commandDispatcher\n                        .getControllerForCommand(aCommand);\n    if (controller && controller.isCommandEnabled(aCommand))\n      controller.doCommand(aCommand);\n  }\n  catch (e) {\n    dump("An error occurred executing the " + aCommand + " command\n" + e + "\n");\n  }\n}\n\n\nfunction goSetCommandEnabled(aID, aEnabled)\n{\n  var node = document.getElementById(aID);\n\n  if (node) {\n    if (aEnabled)\n      node.removeAttribute("disabled");\n    else\n      node.setAttribute("disabled", "true");\n  }\n}\n\nfunction goSetMenuValue(aCommand, aLabelAttribute)\n{\n  var commandNode = top.document.getElementById(aCommand);\n  if (commandNode) {\n    var label = commandNode.getAttribute(aLabelAttribute);\n    if (label)\n      commandNode.setAttribute("label", label);\n  }\n}\n\nfunction goSetAccessKey(aCommand, aValueAttribute)\n{\n  var commandNode = top.document.getElementById(aCommand);\n  if (commandNode) {\n    var value = commandNode.getAttribute(aValueAttribute);\n    if (value)\n      commandNode.setAttribute("accesskey", value);\n  }\n}\n\n// this function is used to inform all the controllers attached to a node that an event has occurred\n// (e.g. the tree controllers need to be informed of blur events so that they can change some of the\n// menu items back to their default values)\nfunction goOnEvent(aNode, aEvent)\n{\n  var numControllers = aNode.controllers.getControllerCount();\n  var controller;\n\n  for (var controllerIndex = 0; controllerIndex < numControllers; controllerIndex++) {\n    controller = aNode.controllers.getControllerAt(controllerIndex);\n    if (controller)\n      controller.onEvent(aEvent);\n  }\n}\n\nfunction visitLink(aEvent) {\n  var node = aEvent.target;\n  while (node.nodeType != Node.ELEMENT_NODE)\n    node = node.parentNode;\n  var url = node.getAttribute("link");\n  if (!url)\n    return;\n\n  var protocolSvc = Components.classes["@mozilla.org/uriloader/external-protocol-service;1"]\n                              .getService(Components.interfaces.nsIExternalProtocolService);\n  var ioService = Components.classes["@mozilla.org/network/io-service;1"]\n                            .getService(Components.interfaces.nsIIOService);\n  var uri = ioService.newURI(url, null, null);\n\n  // if the scheme is not an exposed protocol, then opening this link\n  // should be deferred to the system's external protocol handler\n  if (protocolSvc.isExposedProtocol(uri.scheme)) {\n    var win = window.top;\n    if (win instanceof Components.interfaces.nsIDOMChromeWindow) {\n      while (win.opener && !win.opener.closed)\n        win = win.opener;\n    }\n    win.open(uri.spec);\n  }\n  else\n    protocolSvc.loadUrl(uri);\n}\n\nfunction isValidLeftClick(aEvent, aName)\n{\n  return (aEvent.button == 0 && aEvent.originalTarget.localName == aName);\n}\n\nfunction setTooltipText(aID, aTooltipText)\n{\n  var element = document.getElementById(aID);\n  if (element)\n    element.setAttribute("tooltiptext", aTooltipText);\n}\n\nfunction FillInTooltip ( tipElement )\n{\n  var retVal = false;\n  var textNode = document.getElementById("TOOLTIP-tooltipText");\n  if (textNode) {\n    while (textNode.hasChildNodes())\n      textNode.removeChild(textNode.firstChild);\n    var tipText = tipElement.getAttribute("tooltiptext");\n    if (tipText) {\n      var node = document.createTextNode(tipText);\n      textNode.appendChild(node);\n      retVal = true;\n    }\n  }\n  return retVal;\n}\n\n//@line 44 "/home/sjain/sb/tinderbox/AIX_5.2_Clobber/mozilla/toolkit/content/debug.js"\n\nvar gTraceOnAssert = true;\n\n/**\n * This function provides a simple assertion function for JavaScript.\n * If the condition is true, this function will do nothing.  If the\n * condition is false, then the message will be printed to the console\n * and an alert will appear showing a stack trace, so that the (alpha\n * or nightly) user can file a bug containing it.  For future enhancements, \n * see bugs 330077 and 330078.\n *\n * To suppress the dialogs, you can run with the environment variable\n * XUL_ASSERT_PROMPT set to 0 (if unset, this defaults to 1).\n *\n * @param condition represents the condition that we're asserting to be\n *                  true when we call this function--should be\n *                  something that can be evaluated as a boolean.\n * @param message   a string to be displayed upon failure of the assertion\n */\n\nfunction NS_ASSERT(condition, message) {\n  if (condition)\n    return;\n\n  var releaseBuild = true;\n  var defB = Components.classes["@mozilla.org/preferences-service;1"]\n                       .getService(Components.interfaces.nsIPrefService)\n                       .getDefaultBranch(null);\n  try {\n    switch (defB.getCharPref("app.update.channel")) {\n      case "nightly":\n      case "beta":\n      case "default":\n        releaseBuild = false;\n    }\n  } catch(ex) {}\n\n  var caller = arguments.callee.caller;\n  var assertionText = "ASSERT: " + message + "\n";\n\n  if (releaseBuild) {\n    // Just report the error to the console\n    Components.utils.reportError(assertionText);\n    return;\n  }\n\n  // Otherwise, dump to stdout and launch an assertion failure dialog\n  dump(assertionText);\n\n  var stackText = "";\n  if (gTraceOnAssert) {\n    stackText = "Stack Trace: \n";\n    var count = 0;\n    while (caller) {\n      stackText += count++ + ":" + caller.name + "(";\n      for (var i = 0; i < caller.arguments.length; ++i) {\n        var arg = caller.arguments[i];\n        stackText += arg;\n        if (i < caller.arguments.length - 1)\n          stackText += ",";\n      }\n      stackText += ")\n";\n      caller = caller.arguments.callee.caller;\n    }\n  }\n\n  var environment = Components.classes["@mozilla.org/process/environment;1"].\n                    getService(Components.interfaces.nsIEnvironment);\n  if (environment.exists("XUL_ASSERT_PROMPT") &&\n      !parseInt(environment.get("XUL_ASSERT_PROMPT")))\n    return;\n\n  var source = null;\n  if (this.window)\n    source = window;\n  var ps = Components.classes["@mozilla.org/embedcomp/prompt-service;1"].\n           getService(Components.interfaces.nsIPromptService);\n  ps.alert(source, "Assertion Failed", assertionText + stackText);\n}\n"), line 3389 in "nsXULDocument.cpp"
nsStreamLoader::OnStopRequest(nsIRequest*,nsISupports*,unsigned int)(this = 0x00000001109e00f0, request = 0x0000000110a027d0, ctxt = (nil), aStatus = 0), line 105 in "nsStreamLoader.cpp"
nsJARChannel::OnStopRequest(nsIRequest*,nsISupports*,unsigned int)(this = 0x0000000110a027d0, req = 0x0000000110a02bf0, ctx = (nil), status = 0), line 841 in "nsJARChannel.cpp"
nsInputStreamPump::OnStateStop()(this = 0x0000000110a02bf0), line 576 in "nsInputStreamPump.cpp"
unnamed block $b37982, line 401 in "nsInputStreamPump.cpp"
nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)(this = 0x0000000110a02bf0, stream = 0x0000000110a02ca8), line 401 in "nsInputStreamPump.cpp"
nsInputStreamReadyEvent::Run()(this = 0x0000000110a03110), line 111 in "nsStreamUtils.cpp"
ProcessNextEvent(int,int*)(this = 0x0000000110056610, mayWait = 1, result = 0x0fffffffffffc1e8), line 510 in "nsThread.cpp"
NS_ProcessNextEvent_P(nsIThread*,int)(thread = 0x0000000110056610, mayWait = 1), line 227 in "nsThreadUtils.cpp"
unnamed block $b9743, line 398 in "nsXULWindow.cpp"
nsXULWindow::ShowModal()(this = 0x0000000110957fd0), line 398 in "nsXULWindow.cpp"
ShowAsModal()(this = 0x0000000110970a90), line 524 in "nsContentTreeOwner.cpp"
unnamed block $b10190, line 945 in "nsWindowWatcher.cpp"
nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow*,const char*,const char*,const char*,int,nsIArray*,int,nsIDOMWindow**)(this = 0x00000001106c4d30, aParent = (nil), aUrl = "chrome://global/content/commonDialog.xul", aName = "_blank", aFeatures = "centerscreen,chrome,modal,titlebar", aDialog = 1, argv = 0x000000011051dbd0, aCalledFromJS = 0, _retval = 0x0fffffffffffce90), line 945 in "nsWindowWatcher.cpp"
nsWindowWatcher::OpenWindow(nsIDOMWindow*,const char*,const char*,const char*,nsISupports*,nsIDOMWindow**)(this = 0x00000001106c4d30, aParent = (nil), aUrl = "chrome://global/content/commonDialog.xul", aName = "_blank", aFeatures = "centerscreen,chrome,modal,titlebar", aArguments = 0x000000011051d5f0, _retval = 0x0fffffffffffce90), line 418 in "nsWindowWatcher.cpp"
nsPromptService::DoDialog(nsIDOMWindow*,nsIDialogParamBlock*,const char*)(this = 0x000000011051c7b0, aParent = (nil), aParamBlock = 0x000000011051d5f0, aChromeURL = "chrome://global/content/commonDialog.xul"), line 844 in "nsPromptService.cpp"
nsPromptService::ConfirmEx(nsIDOMWindow*,const unsigned short*,const unsigned short*,unsigned int,const unsigned short*,const unsigned short*,const unsigned short*,const unsigned short*,int*,int*)(this = 0x000000011051c7b0, parent = (nil), dialogTitle = 0x00000001104b18d0, text = 0x000000011051d6b0, buttonFlags = 0, button0Title = 0x00000001104b4170, button1Title = 0x00000001104b1450, button2Title = (nil), checkMsg = (nil), checkValue = 0x000000011051d910, buttonPressed = 0x000000011051d928), line 461 in "nsPromptService.cpp"


Reproducible: Always

Steps to Reproduce:
1.Build Mozilla Firefox Trunk build on AIX with Gnome 2.12 RPMS of 64 bit
version.
2.
3.
Actual Results:  
Firefox crashes 

Expected Results:  
Firefox should not crash

Comment 1

[Shailen]

Looks like the fix for bug# 402742 is causing the crash. 

Firefox build(version=3.0b3pre) on AIX runs fine if the fix for bug# 402742 is excluded from the build version 3.0b3pre.

Comment 2

[Shailen]

Attachment: Patch V1

It seems the issue is not related to the fix for bug# 402742 but the fix has triggered passing '-1' to the below function in mozilla/modules/libpr0n/decoders/icon/nsIconURI.cpp 

 NS_IMETHODIMP
 nsMozIconURI::GetIconState(nsACString &aState)
 {
   if (mIconState)
     aState = kStateStrings[mIconState];
   else
     aState.Truncate();
   return NS_OK;
 }

and thus ending up in making 'aState' as invalid string.

Attaching a patch to rectify the above scenario when '-1' being passed.

Comment 3

[Reed Loden [:reed]]

Comment on attachment 296519 [details] [diff] [review]
Patch V1

Simple crash fix for AIX.

Comment 4

[Reed Loden [:reed]]

Checking in modules/libpr0n/decoders/icon/nsIconURI.cpp;
/cvsroot/mozilla/modules/libpr0n/decoders/icon/nsIconURI.cpp,v  <--  nsIconURI.cpp
new revision: 1.31; previous revision: 1.30
done