GG crashes FF 3.0.10.0 when uploading image via Wordpress

[GoogleCodeExporter]

What steps will reproduce the problem?
1. open Wordpress edit post page
2. click "UPload photo" button
3.

What is the expected output?
Upload screen displays

 What do you see instead?
FF crashes

What version of the product are you using? On what operating system?
0.5.21.0 on Vista

Please provide any additional information below.

This bug does not happen using Chrome.  Firefox reports this as the 20th
most common crash lately so it's a big problem for FF & WP users.

Original issue reported on code.google.com by richard1...@centurylink.net on 1 Jun 2009 at 9:11

[GoogleCodeExporter]

Michael, could you look at this?

Original comment by j...@chromium.org on 1 Jun 2009 at 6:22

• Changed state: Accepted
• Added labels: Crash

[GoogleCodeExporter]

will do

Original comment by micha...@chromium.org on 1 Jun 2009 at 7:02

[GoogleCodeExporter]

I just created a wordpress account and with Gears 0.5.16 nothing went wrong, 
with Gears 
0.5.21... click the image button and BOOM.

I'll run a debug build and see what's happening.

Original comment by micha...@chromium.org on 4 Jun 2009 at 2:36

[GoogleCodeExporter]

That corresponds to my user experience.  I never had a problem using previous
versions of Gears.  It only happened after 0.5.21 came out.

Original comment by richard1...@centurylink.net on 4 Jun 2009 at 5:37

[GoogleCodeExporter]

I'm running FF 3.0.5 on XP.

The crash is in newly introduced drag-and-drop related stuff. This code path 
executes when simply creating a Gears Factory object. The client page doesn't 
have to use the 
new drag and drop features to get this crash. That does a lot to explain the 
frequency of the crash.

// file dom_utils.cc

nsresult DOMUtils::GetTabNativeWindow(JSContext *js_context,
                                      NativeWindowPtr* window) {

  ....

  nsCOMPtr<nsIBaseWindow> baseWindow(do_QueryInterface(ds, &nr));
  if (NS_FAILED(nr)) { return nr; }
  nsCOMPtr<nsIWidget> widget;
  nr = baseWindow->GetMainWidget(getter_AddRefs(widget));
  if (NS_FAILED(nr)) { return nr; }
  *window = reinterpret_cast<NativeWindowPtr>(
      widget->GetNativeData(NS_NATIVE_WINDOW));    <---- CRASHES HERE BECAUSE 'widget' IS NULL

  return NS_OK;
}

Here's a chunk of the callstack

    gears.dll!nsCOMPtr<nsIBaseWindow>::assign_assuming_AddRef(nsIBaseWindow * newPtr=0x00000001)  Line 565 + 0x14 bytes C++
    gears.dll!nsCOMPtr<nsIWidget>::operator->()  Line 868 + 0x24 bytes  C++
>   gears.dll!DOMUtils::GetTabNativeWindow(JSContext * js_context=0x01eb40b0, 
HWND__ * * window=0x0012f2bc)  Line 197 + 0x8 bytes C++
    gears.dll!DropTargetInterceptor::Intercept(ModuleEnvironment * module_environment=0x02a26c00)  Line 258 + 0x16 bytes    C++
    gears.dll!ModuleEnvironment::ModuleEnvironment(SecurityOrigin security_origin={...}, bool is_worker=false, JsRunnerInterface * js_runner=0x02a26518, 
BrowsingContext * browsing_context=0x00000000)  Line 88 + 0x9 bytes C++
    gears.dll!ModuleEnvironment::CreateFromDOM()  Line 123 + 0x57 bytes C++
    gears.dll!GearsFactory::InitFactoryFromDOM()  Line 56 + 0x5 bytes   C++
    gears.dll!GearsFactoryConstructor(nsISupports * aOuter=0x00000000, const nsID & aIID={...}, void * * aResult=0x0012f5f0)  Line 239 + 0x83 bytes C++
    gears.dll!nsGenericFactory::CreateInstance()  + 0x1c bytes  C++

Original comment by micha...@chromium.org on 4 Jun 2009 at 5:38

[GoogleCodeExporter]

Yikes, this is by far the #1 crash for Gears.FF !!!

http://crash/stackview?product=Google_Gears&version=0.5.21.0+(win32+firefox)&num
=50

http://crash/reportview?
product=Google_Gears&version=0.5.21.0+(win32+firefox)&date=&signature=DOMUtils::
GetTabNativeWindow(JSContext+*,HWND__+*+*)-BC8F8

Original comment by micha...@chromium.org on 4 Jun 2009 at 7:00

[GoogleCodeExporter]

It looks like, in the WordPress upload-an-image page, the GearsFactory is being 
created in an invisible IFRAME.

This crashes on Firefox2/WinXP and Firefox3/Vista, but does not crash on 
Firefox3/Linux.

I'm working on a fix.

Original comment by nigel.ta...@gmail.com on 5 Jun 2009 at 1:00

[GoogleCodeExporter]

I think this may be related because it started happening at the same time as the
Wordpress issue. My hometown newspaper crashes Firefox when Gears is enabled.

http://www.nevadaappeal.com/

When Gears is disabled the site opens fine. I've confirmed this on two 
computers.
Both running Firefox 3.0.10 and Gears 0.5.21.0 on Windows Vista Business.

Original comment by scottsch...@gmail.com on 6 Jun 2009 at 4:46

[GoogleCodeExporter]

Issue 887 has been merged into this issue.

Original comment by nigel.ta...@gmail.com on 10 Jun 2009 at 12:48

[GoogleCodeExporter]

Issue 882 has been merged into this issue.

Original comment by nigel.ta...@gmail.com on 10 Jun 2009 at 12:52

[GoogleCodeExporter]

Issue 891 has been merged into this issue.

Original comment by nigel.ta...@gmail.com on 15 Jun 2009 at 12:46

[GoogleCodeExporter]

An application I work on also has this problem, as it uses a hidden iframe. I 
have
confirmed the problem on Firefox 2 and Firefox 3 on Windows XP. Luckily most of 
our
users are still on IE 6, which seems to be OK, however we have been trying to 
get
them to switch to Firefox, but I guess now is not a good time. The crash 
happens when
the GearsFactory object is created as mentioned above. Any idea when we might 
see a
fix? Thanks.

Original comment by jacow...@gmail.com on 15 Jun 2009 at 8:15