57175 - Crash when trying to install Chameleon

Status: VERIFIED WORKSFORME

(Core :: JavaScript Engine, defect, P3)

Description

[Peter Lubczynski]

Tested using trunk pull from 10/17 on Win32 (NT)

Steps to reproduce:
1) Go to the URL present
2) Click on the "nightly" link halfway down the page under Chameleon 0.02. This 
should install this app (but doesn't)
3) Since this didn't work, try clicking on the "file" link below that
4) We crash. 

Here is the stack trace which I think points to Javascript as the culprit:
js_GC(JSContext * 0x0c6f6450, unsigned int 0) line 1171 + 15 bytes
js_ForceGC(JSContext * 0x0c6f6450) line 910 + 11 bytes
JS_GC(JSContext * 0x0c6f6450) line 1542 + 9 bytes
nsJSContext::GC(nsJSContext * const 0x0c6f6600) line 1287 + 13 bytes
GlobalWindowImpl::SetNewDocument(GlobalWindowImpl * const 0x0c6f6670, 
nsIDOMDocument * 0x0e29be84) line 366
DocumentViewerImpl::Init(DocumentViewerImpl * const 0x0e29cc80, nsIWidget * 
0x0c6d0224, nsIDeviceContext * 0x0c6f6da0, const nsRect & {...}) line 537
nsDocShell::SetupNewViewer(nsDocShell * const 0x0c6d09a0, nsIContentViewer * 
0x0e29cc80) line 2865 + 66 bytes
nsWebShell::SetupNewViewer(nsWebShell * const 0x0c6d09a0, nsIContentViewer * 
0x0e29cc80) line 350 + 13 bytes
nsDocShell::Embed(nsDocShell * const 0x0c6d09c0, nsIContentViewer * 0x0e29cc80, 
const char * 0x01d211c4, nsISupports * 0x00000000) line 2497 + 23 bytes
nsWebShell::Embed(nsWebShell * const 0x0c6d09c0, nsIContentViewer * 0x0e29cc80, 
const char * 0x01d211c4, nsISupports * 0x00000000) line 383
nsDocShell::CreateContentViewer(nsDocShell * const 0x0c6d09a0, const char * 
0x0012f920, nsIChannel * 0x0c6f4b40, nsIStreamListener * * 0x0012f974) line 2678 
+ 32 bytes
nsDSURIContentListener::DoContent(nsDSURIContentListener * const 0x0c6d06c0, 
const char * 0x0012f920, int 7, const char * 0x100a66c8 gCommonEmptyBuffer, 
nsIChannel * 0x0c6f4b40, nsIStreamListener * * 0x0012f974, int * 0x0012f904) 
line 103 + 33 bytes
nsDocumentOpenInfo::DispatchContent(nsIChannel * 0x0c6f4b40, nsISupports * 
0x00000000) line 359 + 109 bytes
nsDocumentOpenInfo::OnStartRequest(nsDocumentOpenInfo * const 0x0c6f0be0, 
nsIChannel * 0x0c6f4b40, nsISupports * 0x00000000) line 233 + 16 bytes
nsHTTPFinalListener::OnStartRequest(nsHTTPFinalListener * const 0x0c6f0cb0, 
nsIChannel * 0x0c6f4b40, nsISupports * 0x00000000) line 1122
InterceptStreamListener::OnStartRequest(InterceptStreamListener * const 
0x0e29a2f0, nsIChannel * 0x0c6f4b40, nsISupports * 0x00000000) line 1186
nsHTTPServerListener::FinishedResponseHeaders() line 1047 + 48 bytes
nsHTTPServerListener::OnDataAvailable(nsHTTPServerListener * const 0x0e299e10, 
nsIChannel * 0x0e3003e4, nsISupports * 0x0c6f4b40, nsIInputStream * 0x0e29aef0, 
unsigned int 0, unsigned int 1125) line 427 + 8 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x0e298850) 
line 400 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x0e298070) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x0e298070) line 576 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0c71b4a0) line 509 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00140702, unsigned int 49361, unsigned int 0, 
long 208778400) line 1054 + 9 bytes
USER32! 77e7124c()
0c71b4a0()

Comment 1

[Mitesh Shah]

I checked with Netscape 4.76 and there is a javascript error: 
"InstallTrigger is not defined."
Mozilla instead of giving this error - crashes.

Comment 2

[Phil Schwartau]

I found that "InstallTrigger" is a native XPInstall object,
new to N6/Mozilla. NN4.7 doesn't recognize it, but N6/Mozilla do; 
so that is not the problem. 


Actually, marking WORKSFORME. I cannot crash following the steps above.
I even varied the steps to try allowing the install or not allowing it
before I clicked on the "file" link.

Using WinNT MN6-branch binary 2000102609.
      Linux MN6-branch binary 2000102609.
      Mac   MN6-branch binary 2000102608.

Comment 3

[Phil Schwartau]

Marking Verified - please reopen if this is still crashing on recent builds.