57506 - Javascript opening new window causes crash

Status: VERIFIED WORKSFORME

(SeaMonkey :: UI Design, defect, P3)

Description

[Reinout van Schouwen]

The CD-ROM that comes with the Dutch PC-Active magazine has a HTML/javascript
interface which is loaded with the window.open() function.
Mozilla draws a 640x480 window and then crashes. in the console it says:

line 0: uncaught exception:[Exception... "Component returned failure code:
0x80004003 (NS_ERROR_INVALID_POINTER) [nsIRDFService.GetDataSource]" nsresult:
"0x80004003 (NS_ERROR_INVALID_POINTER)| location: "JS frame ::
chrome://communicator/content/sidebar/sidebarOverlay.js :: sidebar_overlay_init
:: line 536"data: no]

in SetSecurityButton
GpiDeleteSetId failed, error = 0x2033
GpiDeleteSetId failed, error=0x2033

---
in POPUPLOG.OS2:

GFX_OS2.DLL 0001:00006b57

I am not sure if this bug is OS/2 specific or not.
Tested on Warp 4/FP14, SDD b32

Comment 1

[Conor Lennon]

Have you got any Javascript or Html that crashes Mozilla?
If so, can you attach it.

Comment 2

[Phil Schwartau]

Since the error is in sidebarOverlay.js, reassigning to Sidebar component.
But I'm afraid this bug will have to be closed unless there is a way 
we can reproduce the bug; for example, an attached testcase...

Comment 3

[Phil Schwartau]

For reference, here is the sidebar_overlay_init() function:

 

//////////////////////////////////////////////////////////////
// Sidebar Init
//////////////////////////////////////////////////////////////
function sidebar_overlay_init() {
  sidebarObj.panels = new sbPanelList('sidebar-panels');
  sidebarObj.datasource_uri = get_sidebar_datasource_uri();
  sidebarObj.resource = 'urn:sidebar:current-panel-list';
  
  sidebarObj.master_datasources = "";
  sidebarObj.master_datasources = get_remote_datasource_url();
  sidebarObj.master_datasources += " 
chrome://communicator/content/sidebar/local-panels.rdf";
  sidebarObj.master_resource = 'urn:sidebar:master-panel-list';
  sidebarObj.component = document.firstChild.getAttribute('windowtype');
  debug("sidebarObj.component is " + sidebarObj.component);

  // Initialize the display
  var sidebar_element = document.getElementById('sidebar-box');
  var sidebar_menuitem = document.getElementById('sidebar-menu');
  if (sidebar_is_hidden()) {
    if (sidebar_menuitem) {
      sidebar_menuitem.setAttribute('checked', 'false');
    }
  } else {
    if (sidebar_menuitem) {
      sidebar_menuitem.setAttribute('checked', 'true');
    }
    
    if (sidebarObj.never_built) {
      sidebarObj.never_built = false;

      debug("sidebar = " + sidebarObj);
      debug("sidebarObj.resource = " + sidebarObj.resource);
      debug("sidebarObj.datasource_uri = " + sidebarObj.datasource_uri);

      // Show the header for the panels area. Use a splitter if there
      // is stuff over the panels area.
      var sidebar_panels_splitter =  
document.getElementById('sidebar-panels-splitter');

      if (sidebar_element.firstChild != sidebar_panels_splitter) {
        debug("Showing the panels splitter");
        sidebar_panels_splitter.removeAttribute('hidden');
      }
      
      // Add the user's current panel choices to the template builder,
      // which will aggregate it with the other datasources that describe
      // the individual panel's title, customize URL, and content URL.
      var panels = document.getElementById('sidebar-panels');
      
panels.database.AddDataSource(RDF.GetDataSource(sidebarObj.datasource_uri));
      
      debug("Adding observer to database.");
      panels.database.AddObserver(panel_observer);

      // XXX This is a hack to force re-display
      panels.setAttribute('ref', sidebarObj.resource);
    }
    if (sidebar_is_collapsed()) {
      sidebarObj.collapsed = true;
    } else {
      sidebarObj.collapsed = false;
    }
    sidebar_open_default_panel(100, 0);
  }
}

Comment 4

[Phil Schwartau]

OOPS  - the reported error was 

               GpiDeleteSetId failed, error = 0x2033


LXR shows this function in two places: 

               gfx/src/os2/nsDrawingSurfaceOS2.cpp
               gfx/src/os2/nsFontMetricsOS2.cpp


Reassigning to XP Apps: GUI Features for further triage. 


[e-mail], is there any other way we can reproduce the bug?
Otherwise it may have to be closed - thanks.

Comment 5

[Reinout van Schouwen]

Attachment: Source which opens the new window

Comment 6

[Reinout van Schouwen]

Attachment: Source which is loaded in the newly created window

Comment 7

[Reinout van Schouwen]

I attached the "offending" HTML source. Sorry it had to take this long.

Comment 8

[sairuh (rarely reading bugmail)]

hi Michael, is this something you're able to repro? [i don't have an os/2 box to
test this on...] thx!

Comment 9

[Mike Kaply [:mkaply]]

This crashed for me XP.

Save the first attachment as first.html

Save the second attachment as frame.html, rand.html AND hoofd.html

Put them all in the same directory.

Open first.html

Trap.

Comment 10

[Marcia Knous [:marcia]]

Netscape nav triage team: per Alec Flett's pre-triage recommendation, this 
bug is nsbeta1-.

Comment 11

[Tony Jordan]

confirmed crash on win 98  build 2001021508 (m.8)

Comment 12

[Paul Chen]

Marking nsbeta1- bugs as future to get off the radar

Comment 13

[Blake Ross]

Still crashing?  Anyone got a stack trace, if so?

Comment 14

[Blake Ross]

No one answered, and I can't reproduce from what's given, so...

Comment 15

[sairuh (rarely reading bugmail)]

i don't crash either --vrfy wfm using 2001.05.31.0x comm bits on linux, mac and
winnt.