94102 - core dump using nsIXMLHttpRequest->send from script

Status: RESOLVED FIXED

(Core :: XML, defect, P3)

Description

[Pete Collins (MDG)]

This code below will result in a core dump.

Assigning to myself. I'll take a look.

--pete


<script>
<![CDATA[

const PROG_ID           = "@mozilla.org/xmlextras/xmlhttprequest;1";
var C                   = Components;
var nsIXMLHttpRequest   = C.interfaces.nsIXMLHttpRequest;

var comp = C.classes[PROG_ID].getService(nsIXMLHttpRequest);

comp.open("GET", "http://www.mozilla.org/", false, null, null);

comp.send(null);

dump("ResponseXML = "+comp.ResponseXML+'\n');


]]>
</script>

Comment 1

[Peter Bojanic]

Updating with the oeone keyword. Adding Garth Smedley to the cc list.

We use this code to send requests from our registration application to the server.

Comment 2

[Heikki Toivonen (remove -bugzilla when emailing directly)]

There are several things wrong with the sample. You create the object in a funny
way, which might be the cause - the nsIXMLHttpRequest is a subset of the full
interface the JS object supports. I would think that it still shouldn't crash,
but Cc'd jst for insights...

Please do these changes:

1. Replace 

const PROG_ID           = "@mozilla.org/xmlextras/xmlhttprequest;1";
var C                   = Components;
var nsIXMLHttpRequest   = C.interfaces.nsIXMLHttpRequest;

var comp = C.classes[PROG_ID].getService(nsIXMLHttpRequest);

   with

var comp = new XMLHttpRequest();

2. You have typo in the propetry name, all property names start with lower case
letter so comp.responseXML (notice lower case 'r').

3. If this sample lives in an HTML file, remove CDATA section markers.

Btw, if you have any XML Extras bugs, please Cc me on them. And please read
http://www.mozilla.org/xmlextras/ , it describes how to create the
XMLHttpRequest object and documents some other differences with IE's implementation.

Comment 3

[Pete Collins (MDG)]

pushing back

Comment 4

[Pete Collins (MDG)]

core dumps should never  happen.

pushing back

Comment 5

[Peter Bojanic]

Nominating for mozilla1.0

Comment 6

[jim-patterson]

I've been encountering a similar bug for a while now. It's elusive because
stepping through the code in Venkman seems to "fix" it. However, I did get a
traceback (and there are several Talkback traces recorded on it).

I have a patch that corrects the crash for me. I don't know if it's safe, though
(if there is any cleanup to do, I didn't do it). If someone more familiar with
the code could examine it, I'd appreciate it.

Here it is:

*** js/src/jsinterp.c.~3.104.~	Sat Apr 27 22:12:53 2002
--- js/src/jsinterp.c	Wed May 15 22:05:40 2002
***************
*** 1104,1109 ****
--- 1104,1111 ----
      JSBool isFunction;
      jsval value;
  
+     if (obj==NULL)
+         return JS_FALSE;
      if (!OBJ_LOOKUP_PROPERTY(cx, obj, id, &obj2, &prop))
          return JS_FALSE;
      *foundp = (prop != NULL);

Comment 7

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Cc brendan since proposed fix is in JS engine.

Comment 8

[Brendan Eich [:brendan]]

That's not a fix, obj should never be null -- if it is, something is wrong
elsewhere and a patch should fix that other place.  Taking, hope I can debug
this....

/be

Comment 9

[Brendan Eich [:brendan]]

Pete, et al.: here's what I get with a pretty up-to-date trunk optimized xpcshell:

[~/src/trunk-opt/mozilla/dist/bin]$ LD_LIBRARY_PATH=. ./xpcshell /tmp/foo.js
Warning: MOZILLA_FIVE_HOME not set.
Warning: MOZILLA_FIVE_HOME not set.
uncaught exception: [Exception... "Component returned failure code: 0xc1f30001
(NS_ERROR_NOT_INITIALIZED) [nsIXMLHttpRequest.send]"  nsresult: "0xc1f30001
(NS_ERROR_NOT_INITIALIZED)"  location: "JS frame :: /tmp/foo.js :: <TOP_LEVEL>
:: line 9"  data: no]

No crash.  My foo.js is exactly what's in this bug's initial comment, including
the wrong capitalization.  I'm reassigning back and destressing. :-)

Jim Patterson, your patch must be for another bug than the one reported with a
testcase here.  Please file a new bug with a testcase, or some hints about how
to reproduce, or what you might have been doing -- or (if you can catch things
in a debugger) the stack backtrace, including string arguments, at the crash point.

/be

Comment 10

[Pete Collins (MDG)]

I can verify, this code doesn't crash anymore (from xpcshell). 

Don't you just love when you ginore a bug for 10 months, it just goes away.

Marking fixed. 

--pete

Comment 11

[jim-patterson]

All I can say that it looked pretty similar to what I was doing. I've logged a
new bug as suggested. See http://bugzilla.mozilla.org/show_bug.cgi?id=146596 for
the bug and a URL to make it happen.

Comment 12

[Ana]

I'm doing:

const PROG_ID           = "@mozilla.org/xmlextras/xmlhttprequest;1";
var C                   = Components;
var nsIXMLHttpRequest   = C.interfaces.nsIXMLHttpRequest;

var comp = C.classes[PROG_ID].getService(nsIXMLHttpRequest);

I get this error:

Error: uncaught exception: Permission denied to get property 
UnknownClass.classes

Comment 13

[Ana]

If I make the changes:

var senddata="<?xml version="1.0" encoding="ISO-8859-1"?
><Request><Operation>Connect</Operation></Request>";
var comp=new XMLHttpRequest();
comp.open("POST",url_ini+"RPC2",false,null,null);
comp.send(senddata);

I get this error:

Error: uncaught exception: [Exception... "Could not convert JavaScript argument 
arg 0 [nsIXMLHttpRequest.send]"  nsresult: "0x80570009 
(NS_ERROR_XPC_BAD_CONVERT_JS)"  location: "JS frame :: 
http://localhost:8080/list_queues.htm?QM_amart5;false;ns :: doConnectNs :: line 
47"  data: no]