70158 - opening ftp file through a directory via bookmark manager causes crash

Status: VERIFIED WORKSFORME

(SeaMonkey :: Bookmarks & History, defect, P1)

Description

[Bradley Baetz]

To reproduce:
1. Create a bookmark to ftp://ftp.netscape.com/ (with the ending /)
2. In the bookmarks manager, click on the twisty to open up the ftp directory
3. double click on "Welcome"

You should see the file in a new browser window, but instead you get a crash
(backtrace below). I'm not sure that this belongs to the JS engine, and I do
have fairly large patches to the dirviewer, but without those patches, the
correct RDF attributes don't get asserted, so nothing happens (verified by
someone on #mozillazine). See bug #49334 - it should be checked in soon,
hopefully.

file urls (which are handled separately) don't cause the crash. If you move the
ftp bookmark onto the personal toolbar, you can select things from that without
problems (you have to wiggle the mouse over the folder few times to refresh the
contents though) If you don't use the dirviewer (ie bookmark
ftp://ftp.netscape.com/Welcome), it works. The directories don't expand from the
bookmarks menu, so you have to use the manager. (This is a bug I should file at
some point)

Backtrace:
(gdb) bt
#0  0x401b22c6 in JS_GetPrivate (cx=0x87bd440, obj=0x8812a80) at jsapi.c:1854
#1  0x417cf7b1 in nsScriptSecurityManager::GetFunctionObjectPrincipal (
    this=0x81e6da8, cx=0x87bd440, obj=0x8812a80, result=0xbfffe4e0)
    at nsScriptSecurityManager.cpp:904
#2  0x417ce254 in nsScriptSecurityManager::CheckFunctionAccess (
    this=0x81e6da8, aCx=0x87bd440, aFunObj=0x8812a80, aTargetObj=0x87b17d0)
    at nsScriptSecurityManager.cpp:613
#3  0x405db5d5 in nsJSContext::CallEventHandler (this=0x87bd400, 
    aTarget=0x87b17d0, aHandler=0x8812a80, argc=1, argv=0xbfffe5cc, 
    aBoolResult=0xbfffe5c8, aReverseReturnResult=0) at nsJSEnvironment.cpp:934
#4  0x4062f843 in nsJSDOMEventListener::HandleEvent (this=0x8818ab8, 
    aEvent=0x88df9b4) at nsJSDOMEventListener.cpp:91
#5  0x4111bdc1 in nsEventListenerManager::HandleEventSubType (this=0x87d5660, 
    aListenerStruct=0x880ef60, aDOMEvent=0x88df9b4, aCurrentTarget=0x87be648, 
    aSubType=1, aPhaseFlags=7) at nsEventListenerManager.cpp:838
#6  0x4111d85b in nsEventListenerManager::HandleEvent (this=0x87d5660, 
    aPresContext=0x87c0728, aEvent=0xbfffea60, aDOMEvent=0xbfffea18, 
    aCurrentTarget=0x87be648, aFlags=7, aEventStatus=0xbfffea98)
    at nsEventListenerManager.cpp:1415
#7  0x405f1d1d in GlobalWindowImpl::HandleDOMEvent (this=0x87be638, 
    aPresContext=0x87c0728, aEvent=0xbfffea60, aDOMEvent=0xbfffea18, aFlags=1, 
    aEventStatus=0xbfffea98) at nsGlobalWindow.cpp:574
#8  0x412c9f26 in DocumentViewerImpl::LoadComplete (this=0x87bfff8, aStatus=0)
---Type <return> to continue, or q <return> to quit---
    at nsDocumentViewer.cpp:712
#9  0x40e25a5b in nsDocShell::EndPageLoad (this=0x87bc418, 
    aProgress=0x87bc5c4, aChannel=0x87d4418, aStatus=0) at nsDocShell.cpp:2653
#10 0x40e328f8 in nsWebShell::EndPageLoad (this=0x87bc418, 
    aProgress=0x87bc5c4, channel=0x87d4418, aStatus=0) at nsWebShell.cpp:982
#11 0x40e25758 in nsDocShell::OnStateChange (this=0x87bc418, 
    aProgress=0x87bc5c4, aRequest=0x87d4418, aStateFlags=131088, aStatus=0)
    at nsDocShell.cpp:2572
#12 0x40e327dc in nsWebShell::OnStateChange (this=0x87bc418, 
    aProgress=0x87bc5c4, request=0x87d4418, aStateFlags=131088, aStatus=0)
    at nsWebShell.cpp:953
#13 0x40e89c97 in nsDocLoaderImpl::FireOnStateChange (this=0x87bc5b0, 
    aProgress=0x87bc5c4, aRequest=0x87d4418, aStateFlags=131088, aStatus=0)
    at nsDocLoader.cpp:1308
#14 0x40e886b0 in nsDocLoaderImpl::doStopDocumentLoad (this=0x87bc5b0, 
    request=0x87d4418, aStatus=0) at nsDocLoader.cpp:725
#15 0x40e883b4 in nsDocLoaderImpl::DocLoaderIsEmpty (this=0x87bc5b0, aStatus=0)
    at nsDocLoader.cpp:631
#16 0x40e883f4 in nsDocLoaderImpl::DocLoaderIsEmpty (this=0x88dc8b0, aStatus=0)
    at nsDocLoader.cpp:635
#17 0x40e88134 in nsDocLoaderImpl::OnStopRequest (this=0x88dc8b0, 
    request=0x88dcc18, aCtxt=0x0, aStatus=0, aMsg=0x40191244)
    at nsDocLoader.cpp:561
---Type <return> to continue, or q <return> to quit---
#18 0x40c86c5a in nsLoadGroup::RemoveRequest (this=0x88dc940, 
    request=0x88dcc18, ctxt=0x0, aStatus=0, aStatusArg=0x40191244)
    at nsLoadGroup.cpp:518
#19 0x40c88bce in nsStreamIOChannel::OnStopRequest (this=0x88dcc18, 
    request=0x88dcd14, context=0x0, aStatus=0, aStatusArg=0x40191244)
    at nsInputStreamChannel.cpp:475
#20 0x40c79230 in nsOnStopRequestEvent::HandleEvent (this=0x88dce88)
    at nsStreamObserverProxy.cpp:177
#21 0x40c78f63 in nsStreamObserverEvent::HandlePLEvent (aEvent=0x88dce88)
    at nsStreamObserverProxy.cpp:77
#22 0x4011c88c in PL_HandleEvent (self=0x88dce88) at plevent.c:576
#23 0x4011c6ad in PL_ProcessPendingEvents (self=0x80a6910) at plevent.c:509
#24 0x4011e5ee in nsEventQueueImpl::ProcessPendingEvents (this=0x80a68e8)
    at nsEventQueue.cpp:361
#25 0x40771478 in ?? ()
   from /home/bbaetz/src/mozilla/dist/bin/components/libwidget_gtk.so
#26 0x407710a3 in ?? ()
   from /home/bbaetz/src/mozilla/dist/bin/components/libwidget_gtk.so
#27 0x409401a0 in ?? () from /usr/lib/libglib-1.2.so.0
#28 0x40941987 in ?? () from /usr/lib/libglib-1.2.so.0
#29 0x40942001 in ?? () from /usr/lib/libglib-1.2.so.0
#30 0x409421cc in ?? () from /usr/lib/libglib-1.2.so.0
#31 0x4085bf87 in ?? () from /usr/lib/libgtk-1.2.so.0
---Type <return> to continue, or q <return> to quit---
#32 0x40771b49 in ?? ()
   from /home/bbaetz/src/mozilla/dist/bin/components/libwidget_gtk.so
#33 0x40522949 in ?? ()
   from /home/bbaetz/src/mozilla/dist/bin/components/libnsappshell.so
#34 0x08053ebf in main1 (argc=1, argv=0xbffff744, nativeApp=0x0)
    at nsAppRunner.cpp:1004
#35 0x08054b43 in main (argc=1, argv=0xbffff744) at nsAppRunner.cpp:1295
#36 0x4034ef31 in __libc_start_main (main=0x805493c <main>, argc=1, 
    ubp_av=0xbffff744, init=0x804efd4 <_init>, fini=0x805f560 <_fini>, 
    rtld_fini=0x4000e274 <_dl_fini>, stack_end=0xbffff73c)
    at ../sysdeps/generic/libc-start.c:129

Comment 1

[Phil Schwartau]

Reassigning to Bookmarks component for further triage -  


Brad, what build id were you using? I am unable to reproduce the crash. 
When I add the bookmark for ftp://ftp.netscape.com/ and click on the twisty,
I do see the "Welcome" entry underneath it, but the "Location" for it is blank.


Therefore, when I double-click on it, nothing happens whatsoever. 


Also, if I highlight "Welcome" and click the Properties icon, it shows
no properties. Is all this because I don't have the patches you mention for 
dirviewer?  Thanks -   

Comment 2

[Phil Schwartau]

Using Linux debug build from 2001-02-19.

Wow - I got a crash after x-dismissing the Bookmarks window and then the 
main window. I was not even able to get a stack (see below)



CanUnload_enumerate: skipping native
GC Cache:
        hits: 1265  143   49   15    4    4    7    1   10    9
        hits: 1507, misses: 682, hit percent: 68.844223%
JS API usage error: 1 contexts left in runtime upon JS_DestroyRuntime.
JS engine warning: 1978 atoms remain after destroying the JSRuntime.
                   These atoms may point to freed memory. Things reachable
                   through them have not been finalized.
JS engine warning: leaking GC root 'res->input' at 0x8127148
JS engine warning: 1 GC root remains after destroying the JSRuntime.
                   This root may point to freed memory. Objects reachable
                   through it have not been finalized.
Assertion failure: 0 == rv, at ptsynch.c:168

Program received signal SIGABRT, Aborted.
0x403784e1 in ?? () from /lib/libc.so.6
(gdb) 
Continuing.

Program terminated with signal SIGABRT, Aborted.
The program no longer exists.
(gdb) 
The program is not being run.
(gdb) 
The program is not being run.
(gdb) 
The program is not being run.
(gdb) 
The program is not being run.
(gdb) 
The program is not being run.
(gdb) 
The program is not being run.
(gdb) 
The program is not being run.
(gdb) bt
No stack.
(gdb) 

Comment 3

[Bradley Baetz]

Yeah, I've discovered that my gopher patches to the dirindex rdf datasource
(nsDirectoryViewer.cpp) are needed for this feature to work. (I assert the
correct RDF attribute) It did work at some point in the last year though - there
are other bug reports which mention that it worked (eg bug 36224), and people on
IRC knew that this was a feature. (It doesn't work from the bookmark menu, even
with my patches, but does from the personal toolbar)

Marking as depending on that bug, although you should be able to just apply the
diffs to xpfe/components/directory/. I haven't tested that though.

I get that last crash often - I think somethings not being inited/shutdown
correctly when the directoryindex is inited from bookmarks rather than from the
dirviewer. This bug may be related, but I've been avoiding filing these sort of
bugs until my patch land. I thought I tested this one without my patches, but
maybe I forgot to do make install first, or something.

The BM properties have been broken the last few days.

Comment 4

[Keyser Sose]

Adding regression keyword.

Comment 5

[Bradley Baetz]

Removing dependency on the gopher patches, since the crash can happen without
this. Its probably related though - my crash didn't always happen, IIRC.

When this is fixed, the original crash needs to be checked as well.

Comment 6

[Bradley Baetz]

May be related to bug 62401

Comment 7

[Paul Chen]

Marking p1, mozilla0.9.1, nsbeta1+, reassigning to pchen

Comment 8

[Paul Chen]

There are still lots of things wrong with bookmarks, but I can't get this crash
to happen using a linux build pulled today and my mac build that's a day or two old.

First, the bookmark isn't a folder in the manage bookmarks window. Second, it IS
a folder with a twisty in the bookmarks sidebar, and the welcome bookmark loads
without crashing.

Marking worksforme because it doesn't crash anymore.

Comment 9

[Claudius Gayle]

VERIFIED WFM