433853 - Crash [@ nsMsgContentPolicy::ShouldLoad]

Status: RESOLVED FIXED

(MailNews Core :: Backend, defect)

Description

[Mark Banner (:standard8)]

See on crash-stats for 3.0a1 release:

ID: e3d8c6a1-2244-11dd-84a5-001cc45a2ce4
Frame  	Module  	Signature [Expand]  	Source
0 	thunderbird.exe 	nsMsgContentPolicy::ShouldLoad 	mozilla/mailnews/base/src/nsMsgContentPolicy.cpp:340
1 	thunderbird.exe 	nsContentPolicy::CheckPolicy 	mozilla/content/base/src/nsContentPolicy.cpp:157
2 	thunderbird.exe 	nsContentPolicy::ShouldLoad 	mozilla/content/base/src/nsContentPolicy.cpp:218
3 	thunderbird.exe 	NS_CheckContentLoadPolicy 	nsContentPolicyUtils.h:224
4 	thunderbird.exe 	nsExpatDriver::OpenInputStreamFromExternalDTD 	mozilla/parser/htmlparser/src/nsExpatDriver.cpp:813
5 	thunderbird.exe 	nsExpatDriver::HandleExternalEntityRef 	mozilla/parser/htmlparser/src/nsExpatDriver.cpp:731
6 	thunderbird.exe 	Driver_HandleExternalEntityRef 	mozilla/parser/htmlparser/src/nsExpatDriver.cpp:214
7 	thunderbird.exe 	doProlog 	mozilla/parser/expat/lib/xmlparse.c:4598
8 	thunderbird.exe 	prologProcessor 	mozilla/parser/expat/lib/xmlparse.c:3810
9 	thunderbird.exe 	prologInitProcessor 	mozilla/parser/expat/lib/xmlparse.c:3626
10 	thunderbird.exe 	MOZ_XML_Parse 	mozilla/parser/expat/lib/xmlparse.c:1528
11 	thunderbird.exe 	nsExpatDriver::ParseBuffer 	mozilla/parser/htmlparser/src/nsExpatDriver.cpp:1022
12 	thunderbird.exe 	nsExpatDriver::ConsumeToken 	mozilla/parser/htmlparser/src/nsExpatDriver.cpp:1125
13 	thunderbird.exe 	nsParser::Tokenize 	mozilla/parser/htmlparser/src/nsParser.cpp:2423
14 	thunderbird.exe 	nsParser::ResumeParse 	mozilla/parser/htmlparser/src/nsParser.cpp:1649
15 	thunderbird.exe 	nsParser::OnDataAvailable 	mozilla/parser/htmlparser/src/nsParser.cpp:2287
16 	thunderbird.exe 	nsDocumentOpenInfo::OnDataAvailable 	mozilla/uriloader/base/nsURILoader.cpp:306
17 	jar50.dll 	nsJARChannel::OnDataAvailable 	mozilla/modules/libjar/nsJARChannel.cpp:872
18 	thunderbird.exe 	nsInputStreamPump::OnStateTransfer 	mozilla/netwerk/base/src/nsInputStreamPump.cpp:508
19 	thunderbird.exe 	nsInputStreamPump::OnInputStreamReady 	mozilla/netwerk/base/src/nsInputStreamPump.cpp:398
20 	xpcom_core.dll 	nsOutputStreamReadyEvent::Run 	mozilla/xpcom/io/nsStreamUtils.cpp:111
21 	xpcom_core.dll 	nsThread::ProcessNextEvent 	mozilla/xpcom/threads/nsThread.cpp:510
22 	xpcom_core.dll 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:227
23 	thunderbird.exe 	nsXULWindow::ShowModal 	mozilla/xpfe/appshell/src/nsXULWindow.cpp:398
24 	thunderbird.exe 	nsContentTreeOwner::ShowAsModal 	mozilla/xpfe/appshell/src/nsContentTreeOwner.cpp:524
25 	thunderbird.exe 	nsWindowWatcher::OpenWindowJSInternal 	mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:949
26 	thunderbird.exe 	nsWindowWatcher::OpenWindow 	mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp:419
27 	xpcom_core.dll 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
28 	thunderbird.exe 	XPCWrappedNative::CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:2212
29 	thunderbird.exe 	XPC_WN_CallMethod 	mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1473
30 	js3250.dll 	js_Invoke 	mozilla/js/src/jsinterp.c:1296

The line in question:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/base/src/nsMsgContentPolicy.cpp&rev=1.52&mark=340#340

The previous call to GetDocumentElement can return nsnull:

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/content/base/src/nsDocument.cpp&rev=3.828&mark=2963-2976#2963

Hence the source of the crash. Not sure why we don't always see this, but we should handle that case anyway.

Comment 1

[Mark Banner (:standard8)]

Attachment: Proposed Fix

Comment 2

[David :Bienvenu]

Comment on attachment 321048 [details] [diff] [review]
Proposed Fix

but I think I'd say

+  // GetDocumentElement may succeed but return nsnull, if it does, we'll treat the window

Comment 3

[Mark Banner (:standard8)]

Patch checked in -> fixed.