485396 - Crash in [@ NS_GetInnermostURI - nsDOMStorage::InitAsLocalStorage] with Chromebug running

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Michael Kraft [:morac]]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3) Gecko/20090305 Firefox/3.1b3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090326 Minefield/3.6a1pre

Starting with a recently nightly, if I try to run Minefield in "Chromebug mode" by specifying the "-chromebug" parameter, Minefield crashes on startup.

The crashes started occurring with the "Gecko/20090319 Minefield/3.6a1pre" nightly build.  

Based on the call stack and looking at what changed in that time period I would guess that bug 422526 would be the cause.


Reproducible: Always

Steps to Reproduce:

1. Install Chromebug 0.5.0a1 and Firebug 1.4X.0a14 from http://getfirebug.com/releases/index.html
2. Start Minefield with command "firefox -chromebug"


Actual Results:  

Minefield crashes


Expected Results:  

Minefield should not crash.



http://crash-stats.mozilla.com/report/index/65d0425f-97c8-4603-80c5-6da542090325
http://crash-stats.mozilla.com/report/index/8802d6d4-86de-42b0-8a12-c8fbb2090326

Comment 1

[Honza Bambas (:mayhemer)]

I'll do an analyzes and a fix for this. Thanks for the report.

Comment 2

[timeless]

as a quick hint, NS_GetInnermostURI is intentionally not nullsafe, ECALLER

Comment 3

[Honza Bambas (:mayhemer)]

Hmm... is there anything I have to do with Chromebug to trigger the crash? I have installed Firebug and Chromebug as described and FF starts normally. Also, did you have to update FF version in the Firebug's install.rdf?

Comment 4

[Honza Bambas (:mayhemer)]

Attachment: v1 [Checkin comment 5]

Very simple fix. The codepath will prevent returning a crippled localStorage. I could reproduce the crash by clicking the DOM tab in Chromebug.

Comment 5

[Honza Bambas (:mayhemer)]

Comment on attachment 370173 [details] [diff] [review]
v1 [Checkin comment 5]

http://hg.mozilla.org/mozilla-central/rev/0c0a74a303c5

Comment 6

[Michael Kraft [:morac]]

I can verify that it's no longer crashing in the 20090402 nightly trunk load.

Comment 7

[Shawn Wilsher :sdwilsh]

in-testsuite+ with http://hg.mozilla.org/mozilla-central/rev/909d0b9c7c96

Comment 8

[Shawn Wilsher :sdwilsh]

So, it looks like this got landed on 1.9.1, but didn't get marked?  My patch in bug 494453 would not have applied without it, and code beforehand has this change.

Test landed on 1.9.1 as well:
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/3b1fa6b45efc

Doing some checking to see when this got pushed to 1.9.1, then I'll mark with the keyword.

Comment 9

[Shawn Wilsher :sdwilsh]

This was fixed in bug 486654, with http://hg.mozilla.org/releases/mozilla-1.9.1/rev/dc7929b978bb