56705 - passing in NULL for an interface parameter fails

Status: VERIFIED FIXED

(Core Graveyard :: Java to XPCOM Bridge, defect, P3)

Description

[Jon Smirl]

The object passed in is null, GPF in the NS_ADDREF...
bcXPCOMStub::bcXPCOMStub(nsISupports *o) {
    object = o;
    NS_ADDREF(object);
}

IDL for the method:
  void setDocumentHandler(in saxIDocumentHandler handler);

bcXPCOMStub::bcXPCOMStub(nsISupports * 0x00000000) line 32 + 12 bytes
bcXPCOMStubsAndProxies::GetStub(bcXPCOMStubsAndProxies * const 0x009e5c00, 
nsISupports * 0x00000000, bcIStub * * 0x019cfa90) line 56 + 31 bytes
bcXPCOMMarshalToolkit::MarshalElement(bcIMarshaler * 0x009e8f50, void * 
0x009e9b90, nsXPTParamInfo * 0x019cfae0, unsigned char 0x12, unsigned char 
0x00) line 297
bcXPCOMMarshalToolkit::Marshal(bcIMarshaler * 0x009e8f50) line 102 + 44 bytes
bcXPCOMProxy::CallMethod(bcXPCOMProxy * const 0x009e6250, unsigned short 
0x0007, const nsXPTMethodInfo * 0x009613ac, nsXPTCMiniVariant * 0x019cfb8c) 
line 77
PrepareAndDispatch(nsXPTCStubBase * 0x009e6250, unsigned int 0x00000007, 
unsigned int * 0x019cfc3c, unsigned int * 0x019cfc2c) line 100 + 31 bytes
SharedStub() line 124
PX7Servlet::serviceCID(px7IRequest * 0x009e3d60, px7IResponse * 0x009e3c60) 
line 146 + 27 bytes
CID_Handler(request_rec * 0x00925bc8) line 87
ap_invoke_handler(request_rec * 0x00925bc8) line 508 + 10 bytes
process_request_internal(request_rec * 0x00925bc8) line 1215 + 9 bytes
ap_process_request(request_rec * 0x00925bc8) line 1231 + 9 bytes
child_sub_main(int 0x00000002) line 5427 + 9 bytes
child_main(int 0x00000002) line 5493 + 9 bytes
_threadstartex(void * 0x009b5a70) line 212 + 13 bytes
KERNEL32! bff86da1()
KERNEL32! bff84837()
KERNEL32! bff84734()

Comment 1

[Igor Kushnirskiy]

Here is the fix for this bug.
------
Index: bcXPCOMMarshalToolkit.cpp
===================================================================
RCS file: /cvsroot/mozilla/java/xpcom/xpcom/bcXPCOMMarshalToolkit.cpp,v
retrieving revision 1.5
diff -u -r1.5 bcXPCOMMarshalToolkit.cpp
--- bcXPCOMMarshalToolkit.cpp   2000/10/06 08:19:53     1.5
+++ bcXPCOMMarshalToolkit.cpp   2000/10/15 11:07:33
@@ -277,7 +277,7 @@
                 }
                 //printf("--[c++]XPCOMMarshallToolkit INTERFACE
iid=%s\n",iid->ToString());
                 bcOID oid = 0;
-                if (data != NULL) {
+                if (*(char**)data != NULL) {
                     NS_WITH_SERVICE(bcORB, _orb, kORBCIID, &r);
                     if (NS_FAILED(r)) {
                         return r; //nb am I sure about that?
@@ -365,7 +365,7 @@
                     printf("--[c++] we have an interface\n");
                     bcOID oid;
                     um->ReadSimple(&oid,XPTType2bcXPType(type));
-                    printf("%d oid",(int) oid);
+                    printf("%d oid\n",(int) oid);
                     nsIID iid;
                     um->ReadSimple(&iid,bc_T_IID);
                     nsISupports *proxy = NULL;

------
Closing as fixed

Comment 2

[Oleg Khokhlov]

It doesn't crash now.
Verified on WinNT4 SP4, Netscape61_RELEASE branch, JAVADEV_6_1_20010831 branch.

Comment 3

[Alexei V. Mokeev]

Verified.