crash when I try to select a row or to sort a column in a tree [@ nsScriptSecurityManager::CheckPropertyAccessImpl]

RESOLVED DUPLICATE of bug 371694

Status

()

--
critical
RESOLVED DUPLICATE of bug 371694
9 years ago
3 years ago

People

(Reporter: armand.bendanan, Unassigned)

Tracking

({crash})

1.9.1 Branch
x86
All
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

9 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

Since the 3.5.8 version
Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729)
And now the new 3.6 version

My specific XUL application crash firefox every time ...

Reproducible: Always




Vista gives me the following text, I don't know if it can helps :

Problem signature:
  Problem Event Name:	APPCRASH
  Application Name:	firefox.exe
  Application Version:	1.9.2.3667
  Application Timestamp:	4b5102f0
  Fault Module Name:	xul.dll
  Fault Module Version:	1.9.2.3667
  Fault Module Timestamp:	4b5101ce
  Exception Code:	c0000005
  Exception Offset:	0010f46c
  OS Version:	6.0.6002.2.2.0.768.3
  Locale ID:	1036
  Additional Information 1:	3990
  Additional Information 2:	1580ffaf440b5fae3d9e35e1cf400f25
  Additional Information 3:	a571
  Additional Information 4:	a75f79fee6969898b94ca7bc726e6940
(Reporter)

Comment 2

9 years ago
Created attachment 427691 [details]
this is a gnome crash file.

After having launch firefox-bin directly on linux.
I don't know how to produce a core dump ...

Comment 4

9 years ago
Signature	nsScriptSecurityManager::CheckPropertyAccessImpl(unsigned int, nsAXPCNativeCallContext*, JSContext*, JSObject*, nsISupports*, nsIURI*, nsIClassInfo*, char const*, int, void**)
UUID	39b2eb41-957a-45a6-968f-90cbf2100218
Time 	2010-02-18 18:04:18.823719
Uptime	59
Product	Firefox
Version	3.5.8
Build ID	20100202153512
Branch	1.9.1
OS	Linux
OS Version	0.0.0 Linux 2.6.18-53.el5 #1 SMP Wed Oct 10 16:34:02 EDT 2007 i686 GNU/Linux
CPU	x86
CPU Info	AuthenticAMD family 1 model 107 stepping 2
Crash Reason	SIGSEGV
Crash Address	0xdfa380
User Comments	this is the same bug as in vista but here in linux BUG report : 546845
Processor Notes 	
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	nsScriptSecurityManager::CheckPropertyAccessImpl 	caps/src/nsScriptSecurityManager.cpp:814
1 	libxul.so 	nsScriptSecurityManager::CanAccess 	caps/src/nsScriptSecurityManager.cpp:3139
2 	libxul.so 	XPC_WN_DoubleWrappedGetter 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:222
3 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1386
4 	libmozjs.so 	js_InternalInvoke 	js/src/jsinterp.cpp:1447
5 	libmozjs.so 	js_InternalGetOrSet 	js/src/jsinterp.cpp:1510
6 	libmozjs.so 	js_NativeGet 	js/src/jsscope.h:367
7 	libmozjs.so 	js_GetPropertyHelper 	js/src/jsobj.cpp:4333
8 	libmozjs.so 	js_Interpret 	js/src/jsinterp.cpp:4449
9 	libmozjs.so 	js_Invoke 	js/src/jsinterp.cpp:1394
10 	libmozjs.so 	js_InternalInvoke 	js/src/jsinterp.cpp:1447
11 	libmozjs.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5188
12 	libxul.so 	nsJSContext::CallEventHandler 	dom/src/base/nsJSEnvironment.cpp:2107
13 	libxul.so 	nsJSEventListener::HandleEvent 	dom/src/events/nsJSEventListener.cpp:247
14 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1098
15 	libxul.so 	nsEventListenerManager::HandleEvent 	content/events/src/nsEventListenerManager.cpp:1206
16 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventDispatcher.cpp:236
17 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:300
18 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:514
19 	libxul.so 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6323
20 	libxul.so 	PresShell::HandleEventWithTarget 	layout/base/nsPresShell.cpp:6228
21 	libxul.so 	nsEventStateManager::CheckForAndDispatchClick 	content/events/src/nsEventStateManager.cpp:4073
22 	libxul.so 	nsEventStateManager::PostHandleEvent 	content/events/src/nsEventStateManager.cpp:3036
23 	libxul.so 	PresShell::HandleEventInternal 	layout/base/nsPresShell.cpp:6344
24 	libxul.so 	PresShell::HandlePositionedEvent 	layout/base/nsPresShell.cpp:6211
25 	libxul.so 	PresShell::HandleEvent 	layout/base/nsPresShell.cpp:6071
26 	libxul.so 	nsViewManager::HandleEvent 	view/src/nsViewManager.cpp:1400
27 	libxul.so 	nsViewManager::DispatchEvent 	view/src/nsViewManager.cpp:1359
28 	libxul.so 	HandleEvent 	view/src/nsView.cpp:168
29 	libxul.so 	nsWindow::DispatchEvent 	widget/src/gtk2/nsWindow.cpp:577
30 	libxul.so 	nsWindow::OnButtonReleaseEvent 	widget/src/gtk2/nsWindow.cpp:2981
31 	libxul.so 	button_release_event_cb 	widget/src/gtk2/nsWindow.cpp:5555
Assignee: nobody → dveditz
Component: General → Security: CAPS
Keywords: crash
Product: Firefox → Core
QA Contact: general → caps
Summary: crash when I try to select a row or to sort a column in a tree → crash when I try to select a row or to sort a column in a tree [@ nsScriptSecurityManager::CheckPropertyAccessImpl]
Version: unspecified → 1.9.1 Branch
(In reply to comment #0)
> My specific XUL application crash firefox every time ...

Can you construct a test XUL page that will crash Firefox? Is it privileged XUL or unprivileged?

I notice this crash was on the 1.9.1 branch. Some of this code was revamped for Firefox 3.6, do you crash there as well? (1.9.2 branch)
Assignee: dveditz → nobody
Keywords: testcase-wanted
OS: Windows Vista → All
(Reporter)

Comment 6

9 years ago
(In reply to comment #5)
> (In reply to comment #0)
> > My specific XUL application crash firefox every time ...
> Can you construct a test XUL page that will crash Firefox?

YES, I will attach the files.

> Is it privileged XUL or unprivileged?

I don't know ...
(Reporter)

Comment 7

9 years ago
Created attachment 435409 [details]
this is the jsp file that contains the XUL tree element
(Reporter)

Comment 8

9 years ago
Created attachment 435411 [details]
This is the javascript that core dump firefox 3.5.7 AND 3.6

To core dump Firefox, you have to click on a column header of the tree
(Reporter)

Comment 9

9 years ago
The JSP and JS files are served by a apache tomcat engine
(Reporter)

Comment 11

9 years ago
Hi Daniel,
Did you inspect my code?
Did you find some errors in my code?
Do you have any explanation?
Best

Updated

9 years ago
Status: UNCONFIRMED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 371694
Is your problem fixed in a Firefox 4 beta? Because if it's not then this was marked a duplicate of the wrong bug.
(Assignee)

Updated

8 years ago
Crash Signature: [@ nsScriptSecurityManager::CheckPropertyAccessImpl]
Keywords: testcase-wanted
You need to log in before you can comment on or make changes to this bug.