279483 - Crash by click on a link by url www.falk.de [@ js_EmitTree]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Torsten Bondieck]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:1.8a5) Gecko/20041122
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b) Gecko/20050123 

Mozilla crash reproducible by click on a link

Reproducible: Always

Steps to Reproduce:
I have test this error on
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b) Gecko/20050123
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a6) Gecko/20050111

1.) goto Link 'Routenplaner'
2.) under 'Start' write by 'Ort' Magdeburg and under 'Ziel' write by 'Ort' Bansin
3.) Click 'Route berechnen'
4.) Click again 'Route berechnen'
5.) Click on Link 'Zielkarte' for Mozilla Crash

by 
Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:1.8a5) Gecko/20041122
this problem is not existing

Actual Results:  
crash

Expected Results:  
show a country map

Comment 1

[Torsten Bondieck]

Attachment: Talkback result

Comment 2

[Torsten Bondieck]

Attachment: sorry , this is the right attachment

sorry , this is the right attachment

Comment 3

[Hermann Schwab]

Reporter, please start Talkback.exe and copy and paste the IncidentID

Fastfind is showing three incidends with falk.de on Win98/Win2k/MacOSX
StackSignature: JS_ArenaAllocate
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=url&match=contains&searchfor=falk.de&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB3240014Q

I sent one without comment with stack signature:
nsGenericHTMLElement::DOMQueryInterface
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3239549

maybe related to 
Bug 279273 Broken pointer arithmetic in jsarena code

Comment 4

[Mats Palmgren (inactive)]

Attachment: Crash in Linux debug build

Comment 5

[Brendan Eich [:brendan]]

Mats, what is *pn in that top-most js_EmitTree frame (the one that asserts)? Thanks,

/be

Comment 6

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050122

changed steps to repeat, as I didn´t get a crash on map Zielkarte, only leaving it.
1.) goto Link 'Routenplaner'
2.) under 'Start' write by 'Ort' Wixhausen and under 'Ziel' write by 'Ort' Arheilgen
3.) Click 'Route berechnen'
4.) Click on Link 'Anfahrtsplan' for Mozilla Crash

The locations are unique and only 5 minutes apart, so no 2nd command 'Route
berechnen', 'Anfahrtsplan' is a list of roads to take, not a map.
Besides twice 'JS_ArenaAllocate' I got a new signature, js_GetGCThingFlags 
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=3240498#id

JS-Console gives:

Error: [Exception... "'Permission denied to get property XULElement.accessKey'
when calling method: [nsIDOMXULLabelElement::accessKey]"  nsresult: "0x8057001e
(NS_ERROR_XPC_JS_THREW_STRING)"  location: "JS frame ::
http://www.falk.de/redaktion/screenspot/screenspot.js :: openFullscreen :: line
28"  data: no]
Source File: http://www.falk.de/redaktion/screenspot/screenspot.js
Line: 28

	F1 = window.open(seite,'fullscreen','resizable=yes,status=yes,width=' +
window_width + ',height=' + window_height + ',top=' + window_top + ',left='+
window_left + ',fullscreen');


also some CSS errors:

Error: Selector expected.  Ruleset ignored due to bad selector.
Source File: http://www.falk.de/falk_5.css
Line: 18
select,
{  font-family: Arial,Helvetica,sans-serif;}


Error: Expected ':' but found ';'.  Declaration dropped.
Source File: http://www.falk.de/falk_5.css
Line: 208
.navi_index:hover 				{ font-size: 11px; color; color: #304C8A; text-decoration:
underline}

Comment 7

[Torsten Bondieck]

(In reply to comment #3)
> Reporter, please start Talkback.exe and copy and paste the IncidentID

TB3241851Z

Comment 8

[Mats Palmgren (inactive)]

Attachment: More crash data

Brendan, here's *pn ...

Comment 9

[Brendan Eich [:brendan]]

Comment 6 reports symptoms of other bugs or content problems -- please don't
clutter up this bug with them.

/be

Comment 10

[Brendan Eich [:brendan]]

Attachment: fix

Sorry, E4X hacking led to a new token being allocated for a comment, and then
again for the thing after the comment.	Need to back up one in ts->tokens when
going to retry after skipping comments.

/be

Comment 11

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 172212 [details] [diff] [review]
fix

r=shaver

Comment 12

[Brendan Eich [:brendan]]

Fixed, sorry about that!

/be