Bogdan Stroe Reporter
	Description • 21 years ago

As the new UI for ftp upload was checked into the trunk, I wanted to test it.

Steps to reproduce:
1. go to a ftp site so that File->Upload File is enabled.
2. try File->Upload File and watch Mozilla crash

No talkback report since Talkback is not present in the nightly builds (see bug
240234). Windows reports:
AppName: mozilla.exe	 AppVer: 1.8.20040.41908	 ModName: gkwidget.dll
ModVer: 0.0.0.0	 Offset: 00008790

	Bogdan Stroe Reporter
	Comment 1 • 21 years ago

Using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a) Gecko/20040419

	Hermann Schwab
	Comment 2 • 21 years ago

maybe dupe of 
Bug 240798 crash when I try to use "Open File" and "Ctrl-O" to open file [@
nsFilePicker::ShowW ]

	Frank Wein [:mcsmurf]
	Comment 3 • 21 years ago

I get the following stacktrace for this crasher:
nsFilePicker::ShowW(nsFilePicker * const 0x076dd230, short * 0x0012e8e4) line
130 + 11 bytes
nsFilePicker::Show(nsFilePicker * const 0x076dd230, short * 0x0012e8e4) line 378
XPTC_InvokeByIndex(nsISupports * 0x076dd230, unsigned int 0x00000011, unsigned
int 0x00000001, nsXPTCVariant * 0x0012e8e4) line 102
XPCWrappedNative::CallMethod(XPCCallContext & {...}, XPCWrappedNative::CallMode
0x010b4df8) line 2027 + 22 bytes
XPC_WN_CallMethod(JSContext * 0x00f89e90, JSObject * 0x060b4df8, unsigned int
0x00000000, long * 0x08943420, long * 0x08943390) line 1287 + 10 bytes
js_Invoke(JSContext * 0x00000001, unsigned int 0x00000000, unsigned int
0x00000000) line 1281 + 17 bytes
js_Interpret(JSContext * 0x00f89e90, long * 0x0012edb4) line 3367
js_Invoke(JSContext * 0x00000001, unsigned int 0x00000001, unsigned int
0x00000002) line 1301 + 10 bytes
js_InternalInvoke(JSContext * 0x00f89ebc, JSObject * 0x030e60b0, long
0x060b4dc0, unsigned int 0x00000000, unsigned int 0x00000001, long * 0x0012ef7c,
long * 0x0012ef88) line 1378 + 13 bytes
JS_CallFunctionValue(JSContext * 0x00f89e90, JSObject * 0x030e60b0, long
0x060b4dc0, unsigned int 0x00000001, long * 0x0012ef7c, long * 0x0012ef88) line
3618 + 26 bytes
nsJSContext::CallEventHandler(nsJSContext * const 0x0012e69c, JSObject *
0x030e60b0, JSObject * 0x060b4dc0, unsigned int 0x00000001, long * 0x0012ef7c,
long * 0x0012ef88) line 1292 + 24 bytes
nsJSEventListener::HandleEvent(nsJSEventListener * const 0x00000000, nsIDOMEvent
* 0x072c4c48) line 183 + 73 bytes
nsEventListenerManager::HandleEventSubType(nsEventListenerManager * const
0x0012e69c, nsListenerStruct * 0x00fb87b4, nsIDOMEvent * 0x072c4c48,
nsIDOMEventTarget * 0x046ee5c8, unsigned int 0x072c4c54, unsigned int
0x0024ee80) line 1434 + 11 bytes
nsEventListenerManager::HandleEvent(nsEventListenerManager * const 0x00fb87d8,
nsIPresContext * 0x00000000, nsEvent * 0x00000000, nsIDOMEvent * * 0x0012f380,
nsIDOMEventTarget * 0x046ee5c8, unsigned int 0x00000007, nsEventStatus *
0x0012f7c8) line 1512
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0012e69c, nsIPresContext *
0x01120cd8, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x0012f380, unsigned int
0x00000007, nsEventStatus * 0x0012f7c8) line 2790
nsXULElement::HandleDOMEvent(nsXULElement * const 0x0012e69c, nsIPresContext *
0x01120cd8, nsEvent * 0x0012f76c, nsIDOMEvent * * 0x00fb874c, unsigned int
0x00fb8740, nsEventStatus * 0x0012f7c8) line 2622 + 17 bytes
PresShell::HandleDOMEventWithTarget(PresShell * const 0x00f0a328, nsIContent *
0x00f0a328, nsEvent * 0x0012f76c, nsEventStatus * 0x0012f7c8) line 6108
nsMenuFrame::Execute(nsMenuFrame * const 0x0012e69c, nsGUIEvent * 0x0012f9e0)
line 1644 + 20 bytes
nsMenuFrame::HandleEvent(nsMenuFrame * const 0x03d4fe38, nsIPresContext *
0x01120cd8, nsGUIEvent * 0x0012f9e0, nsEventStatus * 0x0012f930) line 443
PresShell::HandleEventInternal(PresShell * const 0x0012e69c, nsEvent *
0x00000000, nsIView * 0x03586fd8, unsigned int 0x00000001, nsEventStatus *
0x0012f930) line 6072 + 19 bytes
PresShell::HandleEvent(PresShell * const 0x00000000, nsIView * 0x03586fd8,
nsGUIEvent * 0x0012f9e0, nsEventStatus * 0x0012f930, int 0x00000000, int &
0x016ad3c0) line 5921 + 19 bytes
nsViewManager::HandleEvent(nsViewManager * const 0x0012e69c, nsView *
0x00000000, nsGUIEvent * 0x0012f9e0, int 0x00000000) line 2236
nsViewManager::DispatchEvent(nsViewManager * const 0x011209c8, nsGUIEvent *
0x036a7060, nsEventStatus * 0x0012f99c) line 1976 + 30 bytes
HandleEvent(nsGUIEvent * 0x0012f9e0) line 79
nsWindow::DispatchEvent(nsWindow * const 0x0380e58c, nsGUIEvent * 0x0012f9e0,
nsEventStatus & nsEventStatus_eIgnore) line 1067 + 3 bytes
nsWindow::DispatchWindowEvent(nsWindow * const 0x0012e69c, nsGUIEvent *
0x00000000) line 1088
nsWindow::DispatchMouseEvent(nsWindow * const 0x0012e69c, unsigned int
0x0000012d, unsigned int 0x00000000, nsPoint * 0x00000000) line 5191
ChildWindow::DispatchMouseEvent(ChildWindow * const 0x0012e69c, unsigned int
0x0000012d, unsigned int 0x00000000, nsPoint * 0x00000000) line 5443 + 19 bytes
nsWindow::ProcessMessage(nsWindow * const 0x0012e69c, unsigned int 0x00000202,
unsigned int 0x00000000, long 0x00c50053, long * 0x0012fce4) line 4020 + 16 bytes
nsWindow::WindowProc(HWND__ * 0x000800da, unsigned int 0x00000202, unsigned int
0x00000000, long 0x0380e58c) line 1349 + 16 bytes
USER32! 77e01ef0()
USER32! 77e0204c()
USER32! 77e021af()
nsAppShellService::Run(nsAppShellService * const 0x0101b050) line 524
main1(int 0x00000000, char * * 0x00242538, nsISupports * 0x00000000) line 1302 +
9 bytes
main(int 0x00000001, char * * 0x00242538) line 1779 + 22 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x001331cb,
HINSTANCE__ * 0x00400000) line 1807 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes
KERNEL32! 77e81af6()

	Boris Zbarsky [:bzbarsky]
	Comment 4 • 21 years ago

Darin, this is all you.  The relevant code in navigator.js is:

1211   // use a pref to remember the displayDirectory selected by the user.
1212   var dir = null;
1213   try {
1214     dir = pref.getComplexValue(lastDirPref,
Components.interfaces.nsILocalFile);
1215   } catch (ex) {
1216   }
1217   fp.displayDirectory = dir;

That will null out the display dir if the pref is not set.  Then line 130 in the
Windows filepicker dereferences it, and crashes.

I'd think you want to let the filepicker default to whatever it wants to if the
pref is not set, no?

I'd also think that SetDisplayDirectory would throw on a bogus arg... or at
least ignore it.

	Boris Zbarsky [:bzbarsky]
	Comment 5 • 21 years ago

Though note bug 24867 comment 190 

	Darin Fisher Assignee
	Comment 6 • 21 years ago

this has been fixed.  see bug 24867 comment 196 for details.

	benc
	Comment 7 • 20 years ago

That fix took on 1.7 branch.
V/1.7 allplats.

	Stephen Donner [:stephend] Not actively reading bugmail
	Comment 8 • 20 years ago

Verified FIXED for the crash ONLY, using build 2004-11-18-05 on Windows XP with
the Seamonkey trunk.