53148 - Crash loading geocites page; does a window.open while loading

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[John Morrison]

Overview Description: 

  This URL will crash Mac, and the same content (to work around
  the fact that the content is different for Mac than Linux or win32
  will also crash Linux). It will not crash win32. 

  This is similar but not identical to bug 52664. In this instance, the
  page throws up a window.open while loading (the other bug was about
  window.alert(), which could crash mac/linux but not win32). 

Steps to Reproduce: 
1) On mac, load http://www.geocities.com/Tokyo/Club/1782/profiles.htm

2) On linux, load 
http://rocknroll/users/jrgm/publish/geocities-windopen-crash.html

Actual Results: Crashes first time on Mac for the Geocities link
                Crashes on reload for Linux for the rocknroll link

Expected Results: Page loads, and popup ads gives me joy

Reproducibility: 100% (sometimes on a second reload for linux)

Build Date & Platform Bug Found: 
  2000091808 macos
  2000091806 linux rh6.1

   DOES NOT OCCUR  2000091805 win2k

Nom. nsbeta3: the web must be safe for spamming popup ads!! 

Seriously, the ads may be a bother, but the crash needs to be avoided for such 
a common use case; it's a straight up window.open, although I'm not sure if 
there isn't something a little unusual about this page (e.g. that background 
image is huge).

Comment 1

[Cyril Bortolato]

Sounds like bug 52734 to me

Comment 2

[John Morrison]

Yeah, I crash with the same stack in either page doing a reload on Linux.

Note though that this is also a Mac bug, and in that case, it is on the initial
load of the page.

Comment 3

[Gagan]

Why is this networking? Can you give us the stack trace? 

Comment 4

[John Morrison]

Sorry, I should have added this earlier. Here's a crash for Linux via talkback 
(my debug Linux lost its debug symbols)

0x00000000 
nsHTTPCacheListener::OnDataAvailable() 
nsDiskCacheRecordChannel::OnDataAvailable() 
nsOnDataAvailableEvent::HandleEvent() 
nsStreamListenerEvent::HandlePLEvent() 
PL_HandleEvent() 
PL_ProcessPendingEvents() 
nsEventQueueImpl::ProcessPendingEvents() 
event_processor_callback() 
our_gdk_io_invoke() 
libglib-1.2.so.0 + 0xe52a (0x4089552a) 
libglib-1.2.so.0 + 0xfbe6 (0x40896be6) 
libglib-1.2.so.0 + 0x101a1 (0x408971a1) 
libglib-1.2.so.0 + 0x10341 (0x40897341) 
libgtk-1.2.so.0 + 0x8c209 (0x407be(0x407be209) 
nsAppShell::Run() 
nsAppShellService::Run() 
main1() 
main() 
libc.so.6 + 0x181eb (0x402571eb) 


Two minor amendments from yesterday's description:
1) The URL is http://rocknroll/users/jrgm/publish/geocities-winopen-crash.html
2) I can hit this crash on initial page load, but apparently after doing 
   a previous visit (not the Cache in the stack).

Comment 5

[John Morrison]

macsbugs log

Calling chain using A6/R1 links
  Back chain  ISA  Caller
  00000000    PPC  1F25B734  
  0F042180    PPC  1F246070  main+00130
  0F042120    PPC  1F2454D8  main1(int, char**, nsISupports*)+00A38
  0F041E40    PPC  1EF230C0  nsAppShellService::Run()+00018
  0F041E00    PPC  1EC269B4  nsAppShell::Run()+00048
  0F041DB0    PPC  1EC270F0  nsMacMessagePump::DoMessagePump()+0003C
  0F041D60    PPC  1EC27704  nsMacMessagePump::DispatchEvent(int, 
EventRecord*)+00174
  0F041D10    PPC  1EC3F3CC  Repeater::DoRepeaters(const EventRecord&)+00030
  0F041CD0    PPC  1EC05528  nsMacNSPREventQueueHandler::RepeatAction(const 
EventRecord&)+0000C
  0F041C90    PPC  1EC05640  
nsMacNSPREventQueueHandler::ProcessPLEventQueue()+000B0
  0F041C20    PPC  1F0CA978  nsEventQueueImpl::ProcessPendingEvents()+00038
  0F041BB0    PPC  1F12C000  PL_ProcessPendingEvents+0005C
  0F041B70    PPC  1F12C184  PL_HandleEvent+00020
  0F041B30    PPC  1ED5C100  
nsStreamListenerEvent::HandlePLEvent(PLEvent*)+00024
  0F041AE0    PPC  1ED5D350  nsOnDataAvailableEvent::HandleEvent()+00068
  0F041A90    PPC  1ED9B380  
nsDiskCacheRecordChannel::OnDataAvailable(nsIChannel*, nsISupports*, 
nsIInputStream*, unsigned int, unsigned int)+00024
  0F041A50    PPC  1EDD9D24  nsHTTPCacheListener::OnDataAvailable(nsIChannel*, 
nsISupports*, nsIInputStream*, unsigned int, unsigned int)+00080

Comment 6

[Gagan]

->neeti,dp

Comment 7

[Blake Ross]

*spam*

adding crash keyword...

Comment 8

[John Morrison]

tever: make sure to check bug 52664 when this is fixed.

Comment 9

[Phil Peterson]

Not holding PR3 for this, marking nsbeta3-.

Comment 10

[Phil Peterson]

*** Bug 52664 has been marked as a duplicate of this bug. ***

Comment 11

[neeti]

This should have been fixed by the fix for bug 52397

Comment 12

[Tom Everingham]

verified:
WinNT4 10/30
Mac os9 10/30
Linux rh6 10/30