54079 - In Composer, Netscape will crash at selecting submenu of HELP

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P1)

Description

[Teruko Kobayashi]

In Composer window, when you select submenu of Help menu, Netscape
will crash.

steps of reproduce
1. Open Composer window
2. Select menu as follows
   Help | What's New in Netscape6?
   Help | New to the Net Tutorial
   Help | Netscape Technical Support
   Help | Security Center
   Help | International Users
   Help | Feedback Center

Netscape will crash.

I sent talkback report at every selection of submenus.
Stack traces are same.

Talkback incident #18012463
 Trigger Type:  Program Crash 

 Trigger Reason:  Access violation 

 Thread ID:   

 Call Stack:    (Signature = nsJSContext::ExecuteScript 92ef1dc1) 
  
 nsJSContext::ExecuteScript 
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 695]

 nsXULDocument::ExecuteScript 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 5586]

 nsXULDocument::LoadScript 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 5443]

 nsXULDocument::ResumeWalk 
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 5272]

 nsXULDocument::CachedChromeStreamListener::OnStopRequest
[d:\builds\seamonkey\mozilla\rdf\content\src\nsXULDocument.cpp, line 6509]
 nsDocumentOpenInfo::OnStopRequest 
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 269]

 nsCachedChromeChannel::HandleStopLoadEvent 
[d:\builds\seamonkey\mozilla\rdf\chrome\src\nsChromeProtocolHandler.cpp, line 
535]

 PL_HandleEvent 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 576]
  
 PL_ProcessPendingEvents 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 512]

 _md_EventReceiverProc 
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1046]
  
 nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 408]

 netscp6.exe + 0x1711 (0x00401711) 
 netscp6.exe + 0x1230 (0x00401230) 
 netscp6.exe + 0x2aae (0x00402aae) 
 KERNEL32.DLL + 0x7903 (0x77e57903) 
                                                               
Tested 2000-09-25-08 Win32 and Linux, and 2000-09-25-12 Mac build.

Comment 1

[Teruko Kobayashi]

Nominating this for beta3.

Comment 2

[rubydoo123]

yes, this is a crasher, assigning to sfraser for debug

Comment 3

[rubydoo123]

milestone

Comment 4

[Phil Peterson]

nsbeta3++ to fix the crash somehow. Removing the Help menu for PR3 is an
acceptable solution if the real fix proves elusive or risky.

Comment 5

[rubydoo123]

realy giving to simon

Comment 6

[Simon Fraser [no longer active]]

This is dependent on bugscape bug 2331.

Comment 7

[Simon Fraser [no longer active]]

The fix for the crash is a simple null check, but after fixing that, help menu 
items cause XUL files to load into the composer content area (for reasons 
described in bugscape bug 2331).

Comment 8

[Simon Fraser [no longer active]]

Patch for the crash:

Index: mozilla/dom/src/base/nsJSEnvironment.cpp
===================================================================
RCS file: /cvsroot/mozilla/dom/src/base/nsJSEnvironment.cpp,v
retrieving revision 1.115
diff -c -2 -r1.115 nsJSEnvironment.cpp
*** nsJSEnvironment.cpp	2000/09/15 06:17:07	1.115
--- nsJSEnvironment.cpp	2000/09/27 03:20:28
***************
*** 692,696 ****
    if (!mScriptsEnabled) {
      *aIsUndefined = PR_TRUE;
!     aRetValue->Truncate();
      return NS_OK;
    }
--- 692,697 ----
    if (!mScriptsEnabled) {
      *aIsUndefined = PR_TRUE;
!     if (aRetValue)
!       aRetValue->Truncate();
      return NS_OK;
    }

Comment 9

[Brendan Eich [:brendan]]

Adding akkana for review (IIRC, she made the change, and I reviewed it badly in 
this case where aRetValue may be null).

a=[e-mail].

/be

Comment 10

[Akkana Peck]

Yes, I agree that it's safer to add the null checks (I had them in my original
code, but was persuaded to remove them because it wasn't supposed to be able to
happen).

Comment 11

[Simon Fraser [no longer active]]

Fix checked in.

Comment 12

[Simon Fraser [no longer active]]

Fix checked in, both XUL/JS fixes, and the C++ patch above.

Comment 13

[Simon Fraser [no longer active]]

Fixed on trunk and branch.

Comment 14

[sujay]

still crashing with 9/28 branch build. 

Talkback Incident ID = 

http://cyclone/reports/incidenttemplate.CFM?reportID=124&style=0&tc=1&cp=1&ck1=SUser+email+address&cd1=%25sujay%40netscape%2Ecom%25&co1=like&bbid=18211196

Comment 15

[Simon Fraser [no longer active]]

This is weird; it's behaving as if it doesn't have my fixes.
Waiting for a commercial mac build to test.

Comment 16

[Simon Fraser [no longer active]]

This works fine in my windows, branch commercial debug build. Maybe a packaging 
issue?

Comment 17

[sujay]

I had the wrong branch bits...it works fine....sorry!

Comment 18

[sujay]

verified in 9/29 branch build.