212501 - Mozilla crashed in js3250.dll after browsing galleries

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jure Repinc (JLP)]

This happened to my friend so I don't have the complete data about this. But he
has sent the talkback report TB21829927Z. Windows XP reported this error:
Faulting application mozilla.exe, version 1.5.20030.5568, faulting module
js3250.dll, version 4.0.0.0, fault address 0x0002307e

He said he was browsing the galleries on this page and then he left his computer
for about half an hour. Then he came back and started browsing again and Mozilla
crashed. He said this has happened to him with Mozilla 1.4 final and now that he
has also sent TB report he is using nightly 2003071108.

Comment 1

[Phil Schwartau]

Confirming based on Talkback stack trace, which I'll attach below.
cc'ing dbradley in case this may be an XPConnect issue. 

Comment 2

[Phil Schwartau]

Attachment: Talkback stack trace

Comment 3

[Phil Schwartau]

[e-mail]: have you or your friend been able to make this
crash happen again? It would be great to have a set of steps we
could follow to reproduce it; thanks.

If the crash is not reproducible, it will be hard to debug this -

Comment 4

[David Bradley]

From what I can see, it looks like the stack is corrupted. The frame pointer
(EBP) is null and if the line numbers are to be believed, it crashed on the
return on the line just before. EIP was null as well, which meant that the area
for the return address and frame pointer were zeroed out before it hit the return.

The puzzling thing is that this would have had to happen between the start of
the function and return, and most of those are pretty trivial functions. EBX is
0x1a4 which isn't valid and from what I can tell should be the address of
tl->owner. Which means that it should have crashed in js_CompareAndSwap. Could
be threads at play here, but really hard to pin anything down from the talkback
data.

I'll run the site with Purify and see if I can turn up anything.

Comment 5

[David Bradley]

One thing I noticed is that ESP value of 0x0012fff8 seems odd. This is similar
to the crash in bug 212767 and bug 171949 in that they're ESP, EBP, and EIP
registers are all in the same state. The 0x0012FFF8 value in the ESP register
seems a little odd, and makes me wonder if the stack wasn't blown. But I would
have expected talkback to report a stack overflow exception and not an access
violtion, but it's probably something to consider.

I ran Purify on this patch, but couldn't produce any failures, but my tree had a
non-trivial patch so I'm going to try again with this and some of the other test
cases to see if I can determine the source of the problem

Comment 6

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031030]
(BuildId=2003110115, bug 224340#c19) (W98SE)

I first got JS3250.DLL crashes last week, when I was using Venkman (JS Debugger)
v0.9.79 for a while:
Started Browser, started Venkman, with(out) JS.C.: Mozilla would often crash
quite soon after defining my break point and starting to load MailNews (which I
was looking at).
I must have had 'disable_xul_cache=true' most of the time.
I though it could be a Venkman issue, and I decided to let it be at the time.

But today, I just had it again, with default 'disable_xul_cache=false', and
without using Venkman at all: simple Browser+MailNews uses.

I was browsing when I got
{
MOZILLA a causé une défaillance de page dans
 le module JS3250.DLL à 0167:00b1b120.
Registres :
EAX=00000000 CS=0167 EIP=00b1b120 EFLGS=00010246
EBX=03eefb38 SS=016f ESP=0066eb04 EBP=0066eb98
ECX=00000000 DS=016f ESI=04170900 FS=0e37
EDX=00696c44 ES=016f EDI=03eefb30 GS=0000
Octets à CS : EIP :
8b 08 ff b2 10 01 00 00 8b 49 04 50 56 ff 51 10 
État de la pile :
0066eb90 03a00703 03eefb38 04170900 006a5654 00000000 0066eb5c 00b27e70 041c0450
ffffffff 00000000 03a0fe7a 80000001 03312cf8 03eefc5c 03eefbd4 
}
I'm using a v1.3_created profile...
I don't have steps to reproduce.

(TalkBack never activates since some milestones ... But I believe that there is
no more built-in TalkBack at this time !!?)

Another related bug: MailNews bug 223502 (and ThunderBird bug 215897).

Comment 7

[Brendan Eich [:brendan]]

Possible dup of bug 206199?

/be

Comment 8

[Bob Clary [:bc] (inactive)]

-> default qa

Comment 9

[Wendy]

I am getting error js 3250.dll every day when I go and enter Mozilla. I uninstall and reinstall and it comes back daily?
What should I do?

Comment 10

[timeless]

js3250.dll is not a small library, 
serge: your minimal footprints don't match the ones for the original bug, you shouldn't have added your feedback here.
wendy: your absolutely vague report is worse than serge's instead of picking this bug, you should look through the rest of the crashers and try to have some useful details. my guess is you're using something like allchars (search, you'll find it). of course, i have absolutely no idea which strange third party program you're using. i'd suggest that you try booting windows in safemode and using firefox for a week. if it doesn't crash in js3250, the problem is some strange application (and then you'd have to get an application list and figure out which).

Comment 11

[Wayne Mery (:wsmwk)]

URL http://www.visualparadox.com/scenic2.htm WFM 
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008040504 Minefield/3.0pre

Comment 12

[Serge Gautherie (:sgautherie)]

(In reply to comment #10)
> serge: your minimal footprints don't match the ones for the original bug, you
> shouldn't have added your feedback here.

Agreed.

(In reply to comment #11)
> URL http://www.visualparadox.com/scenic2.htm WFM 

Wrt my report, I'm fine with the WFM resolution:
I haven't seen such a crash for a long time :-)