gfxTextRun crash on certificate addition window




Layout: Text
9 years ago
5 years ago


(Reporter: Siyivan, Unassigned)



Firefox Tracking Flags

(Not tracked)




9 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv: Gecko/2009011913 Firefox/3.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20090524 Firefox/3.6a1pre

When trying performing the steps to add an exception to https, firefox crashed on gfxTextRun destructor.
Could be related to bug 490480.

Reproducible: Couldn't Reproduce

      operator=( const nsQueryInterface rhs )
          // assign from |do_QueryInterface(expr)|
105DE0FD  push        esi  
          assign_from_qi(rhs, NS_GET_TEMPLATE_IID(T));
105DE0FE  push        dword ptr [esp+8] 
105DE102  mov         edx,offset nsIPrefBranch2::COMTypeInfo<int>::kIID (10685AB8h) 
105DE107  mov         esi,ecx 
105DE109  call        nsCOMPtr_base::assign_from_qi (105987E2h) 
          return *this;
105DE10E  mov         eax,esi 
105DE110  pop         esi  
105DE111  ret         4    
--- No source file
nsAutoPtr<gfxTextRun>::`scalar deleting destructor':
105DE114  push        esi  
105DE115  mov         esi,ecx 
105DE117  mov         ecx,dword ptr [esi] 
105DE119  test        ecx,ecx 
105DE11B  je          nsAutoPtr<gfxTextRun>::`scalar deleting destructor'+0Fh (105DE123h) 
105DE11D  mov         eax,dword ptr [ecx] 
105DE11F  push        1    
105DE121  call        dword ptr [eax] <-- eax = 0
105DE123  test        byte ptr [esp+8],1 
105DE128  je          nsAutoPtr<gfxTextRun>::`scalar deleting destructor'+1Dh (105DE131h) 
105DE12A  push        esi  
105DE12B  call        operator delete (10669A4Ah) 
105DE130  pop         ecx  
105DE131  mov         eax,esi 
105DE133  pop         esi  
105DE134  ret         4    
--- nsthashtable.h 
    // if failed, reset "flag"
    mTable.entrySize = 0;
    return PR_FALSE;

  return PR_TRUE;

	xul.dll!nsAutoPtr<gfxTextRun>::`scalar deleting destructor'()  + 0xd bytes	C++
 	xul.dll!nsTArray<nsAutoPtr<nsForwardReference> >::DestructRange(unsigned int start=0, unsigned int count=1)  Line 862 + 0x9 bytes	C++
 	xul.dll!nsTArray<nsAutoPtr<gfxTextRun> >::RemoveElementsAt(unsigned int start=0, unsigned int count=1)  Line 664	C++
 	xul.dll!PresShell::FireOrClearDelayedEvents(int aFireEvents=64557712)  Line 6862 + 0xa bytes	C++
 	xul.dll!FireOrClearDelayedEvents(nsTArray<nsCOMPtr<nsIDocument> > & aDocuments={...}, int aFireEvents=1)  Line 7509	C++
 	xul.dll!nsDelayedEventDispatcher::Run()  Line 7525 + 0xe bytes	C++
 	xul.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0012e450)  Line 511	C++
 	xul.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x00000001, int mayWait=1)  Line 230 + 0xd bytes	C++
 	xul.dll!nsXULWindow::ShowModal()  Line 415 + 0x8 bytes	C++
 	xul.dll!nsContentTreeOwner::ShowAsModal()  Line 529	C++
 	xul.dll!nsWindowWatcher::OpenWindowJSInternal(nsIDOMWindow * aParent=0x01a4ef10, const char * aUrl=0x0ba12928, const char * aName=0x00000000, const char * aFeatures=0x0012e7b8, int aDialog=1, nsIArray * argv=0x076fa194, int aCalledFromJS=1, nsIDOMWindow * * _retval=0x0012e744)  Line 992	C++
 	xul.dll!nsWindowWatcher::OpenWindowJS(nsIDOMWindow * aParent=0x01a4ef10, const char * aUrl=0x0ba12928, const char * aName=0x00000000, const char * aFeatures=0x0012e7b8, int aDialog=1, nsIArray * argv=0x00000001, nsIDOMWindow * * _retval=0x0012e744)  Line 488 + 0x20 bytes	C++
 	xul.dll!nsGlobalWindow::OpenInternal(const nsAString_internal & aUrl={...}, const nsAString_internal & aName={...}, const nsAString_internal & aOptions={...}, int aDialog=1, int aContentModal=0, int aCalledNoScript=0, int aDoJSFixups=0, nsIArray * argv=0x076fa194, nsISupports * aExtraArgument=0x00000000, nsIPrincipal * aCalleePrincipal=0x00ce4af0, JSContext * aJSCallerContext=0x01ba0720, nsIDOMWindow * * aReturn=0x0012e8d4)  Line 7292 + 0x36 bytes	C++
 	xul.dll!nsGlobalWindow::OpenDialog(const nsAString_internal & aUrl={...}, const nsAString_internal & aName={...}, const nsAString_internal & aOptions={...}, nsIDOMWindow * * _retval=0x0012e8d4)  Line 5145 + 0x2d bytes	C++
 	xul.dll!NS_InvokeByIndex_P(nsISupports * that=0x0000000f, unsigned int methodIndex=4, unsigned int paramCount=1239204, nsXPTCVariant * params=0x01ba0720)  Line 102	C++
 	xul.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...}, XPCWrappedNative::CallMode mode=133131440)  Line 2474 + 0x15 bytes	C++
 	js3250.dll!JS_DHashTableRawRemove(JSDHashTable * table=0x0201e8a8, JSDHashEntryHdr * entry=0x016c397c)  Line 712 + 0x14 bytes	C++
 	js3250.dll!js_LookupPropertyWithFlags(JSContext * cx=0x00000000, JSObject * obj=, int id=, unsigned int flags=, JSObject * * objp=, JSProperty * * propp=)  Line 3802 + 0xc bytes	C++
 	xul.dll!nsWindowSH::NewResolve(nsIXPConnectWrappedNative * wrapper=0x00000000, JSContext * cx=0x020148a0, JSObject * obj=0x00000001, int id=0, unsigned int flags=0, JSObject * * objp=0x00000000, int * _retval=0x00000000)  Line 6043 + 0x32 bytes	C++


9 years ago
Keywords: crash
Component: Layout → Layout: Text
QA Contact: layout → layout.fonts-and-text

Comment 1

8 years ago
Siyivan, are you able to reproduce with current trunk?
Severity: normal → critical

Comment 2

8 years ago
No, but I couldn't either at that time. I have added certificates many times (I assume that probably with the same code) and it only happened once.
So I can't give you a definitive answer about if it got fixed or not.
Please file a new bug if it occurs again. Thanks
Last Resolved: 5 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.