95489 - Trunk, N610 & M094 crash [@ nsScriptLoader::EvaluateScript]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[greer]

This crash is in the top ten of today's N610 windows data with 633 incidents. 
It crashes at the same signature as bug 90362, but comments show that many 
users are not using secure sites. Also, users uptime minutes show that most are 
crashing at startup. Most crashes are on Win 98.

  11 Windows 95  4.0 build 67109814
  35 Windows 95  4.0 build 67109975
  34 Windows 95  4.0 build 67306684
 165 Windows 98  4.10 build 67766222
 201 Windows 98  4.10 build 67766446
 135 Windows 98  4.90 build 73010104
   5 Windows NT  4.0 build 1381
  44 Windows NT  5.0 build 2195
   2 Windows NT  5.1 build 2505
   1 Windows NT  5.1 build 2526

Stack Trace: 

         nsScriptLoader::EvaluateScript
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 534]
         nsScriptLoader::ProcessRequest
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 478]
         nsScriptLoader::ProcessPendingReqests
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 579]
         nsScriptLoader::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 612]
         nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp  line 123]
         nsStreamListenerTee::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp  line 25]
         nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line
2115]
         nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line
161]
         PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  
line 591]
         PL_ProcessPendingEvents        
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c 
line 524]
         _md_EventReceiverProc  
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c 
line 1072]
         KERNEL32.DLL + 0x242e7 (0xbff942e7)
         0x00688b5e
 
        Source File :
http://bonsai.mozilla.org/cvsblame.cgi?
file=mozilla/content/base/src/nsScriptLoader.cpp line : 534

I will attach comments below.

Comment 1

[greer]

Attachment: Comments from talkback report

Comment 2

[karnaze (gone)]

Changing component to dom content.

Comment 3

[Jay Patel [:jay]]

Adding Trunk to summary, since this is also a topcrasher on the MozillaTrunk. 
Here's the info for this crash on the trunk:

nsScriptLoader::EvaluateScript   13
			 95489 	 NEW 	  	 [e-mail] --- 
     First BBID :34338179
     Last BBID  :34588427
     Min Runtime :239
     Max Runtime :89429
     First Appearance Date : 2001-08-21
     Last Appearance Date : 2001-08-27
     First BuildID : 2001082015
     Last BuildID : 2001082706

Stack Trace: 

	 nsScriptLoader::EvaluateScript
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 540]
	 nsScriptLoader::ProcessRequest
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 484]
	 nsScriptLoader::ProcessPendingReqests
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 585]
	 nsScriptLoader::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 618]
	 nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp  line 123]
	 nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2197]
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 162]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 428]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1395]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1712]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1730]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x7903 (0x77e87903)
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/base/src/nsScriptLoader.cpp
line : 540
     (34455528)	Comments: toyfactory [6.1] forced to install manually -- it was working.i
was trying to load the cnn sidebar -- i think

This crash doesn't have a target milestone yet, has anyone taken a look at this
crash yet?

Comment 4

[Blake Ross]

jst, any word on this?

Comment 5

[Jay Patel [:jay]]

This is still a topcrasher on the MozillaTrunk:

nsScriptLoader::EvaluateScript   12
			 95489 	 NEW 	  	 [e-mail] --- 
BBID range: 35464634 - 35785897
Min/Max Seconds since last crash: 697 - 107925
Min/Max Runtime: 869 - 107925
Crash data range: 2001-09-16 to 2001-09-23
Build ID range: 2001091408 to 2001092210

Stack Trace: 

	 nsScriptLoader::EvaluateScript
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 540]
	 nsScriptLoader::ProcessRequest
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 484]
	 nsScriptLoader::ProcessPendingReqests
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 585]
	 nsScriptLoader::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 618]
	 nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp  line 123]
	 nsStreamListenerTee::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp  line 25]
	 nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2220]
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 162]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 KERNEL32.DLL + 0x24407 (0xbff94407)
	 0x00688b5e
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/base/src/nsScriptLoader.cpp
line : 540
     (35785897)	URL: http://www.dilbert.com
(35785897)
Comments: For some strange reason  both Mozilla dn Netscape 4.78 crashed on
access of http://www.dilbert.com on Sunday 9/23/01 .  It worked fine on Netscape
earlier in the day.  My guess is that it will be fixed by tomorrow.
     (35740394)	Comments: Closing a browser window while writing a long email in a compose
window  [:-(] 
(35736301)
Comments: MOZILLA caused an invalid page fault inmodule GKCONTENT.DLL at
0167:6023270a.Registers:EAX=00000000 CS=0167 EIP=6023270a
EFLGS=00010246EBX=03a8ca30 SS=016f ESP=0068f688 EBP=0068f74cECX=0068f740 DS=016f
ESI=03a8ca30 FS=4eafEDX=0068f740 ES=016f
     (35736301)	Comments:  EDI=00000000 GS=0000Bytes at CS:EIP:I was playing at
jackpot.co.8b 08 ff 91 d0 00 00 00 39 7d f4 75 0a be 05 40 Stack dump:00000000
0068f740 0068f768 03ed9bf0 03ed9bf0 03a8ca30 60f23484 00000c55 00000fc0 00000001
00000000 00000000 00cc0000
     (35736301)	Comments:  00000000 0078039d 0036170e 
     (35592737)	Comments: Hitting ctrl-Q to exit

And a M094 topcrasher as well:

nsScriptLoader::EvaluateScript   92
			 95489 	 NEW 	  	 [e-mail] --- 
BBID range: 35404218 - 35790347
Min/Max Seconds since last crash: 48 - 688663
Min/Max Runtime: 48 - 688663
Crash data range: 2001-09-14 to 2001-09-23
Build ID range: 2001091311 to 2001091311

Stack Trace: 

	 nsScriptLoader::EvaluateScript
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 540]
	 nsScriptLoader::ProcessRequest
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 484]
	 nsScriptLoader::ProcessPendingReqests
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 585]
	 nsScriptLoader::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp  line 618]
	 nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp  line 123]
	 nsStreamListenerTee::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp  line 25]
	 nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line 2197]
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 162]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 KERNEL32.DLL + 0x24407 (0xbff94407)
	 0x00688b62
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/content/base/src/nsScriptLoader.cpp
line : 540
     (35783307)	Comments: Was at cnn home page ("www.cnn.com"?) and had just clicked the
"home" button to go to my home page  which is a personalized iWon.com page
("www.iwon.com/my"?). At the same time  in the background  i was using a MS
Access application which was linked to a
     (35783307)	Comments:  database on a remote server (a drive on a remote LAN which I have
mapped).
     (35776574)	URL: sports.espn.go.com/mlb/standings
     (35754984)	URL: www.time.com
(35741957)
URL: http://www.astalavista.box.sk
(35734213)
Comments: opened a link in a new window  then closed it.. nothing seriousalso 
exiting an html that used the qtime plugin crashes it... 
     (35732205)	Comments: Closing browser window.
     (35677434)	Comments: I'm just start MS Internet Explorer
     (35655087)	URL: astalavista.box.sk
     (35655087)	Comments: closing popups.
     (35653041)	URL: www.titanic-magazin.de
(35653041)
Comments: checking e-mails and running a website in background
     (35638905)	URL: www.astalavista.box.sk
(35638905)
Comments: nothing .. 
     (35619707)	URL: www.hewlett-packard.de
(35611307)
Comments: acrobat plugin
     (35593940)	URL: astalavista.box.sk 
     (35593940)	Comments: I was also working with textpad  outlook and others
     (35591120)	URL: http://www.collegeclub.com
(35591120)
Comments: waiting for a page to load
     (35555671)	Comments: closing popup advert script window
     (35542994)	URL: www.jetzt.de
(35542905)
Comments: Closing another instance of Mozilla
     (35542614)	URL: www.jetzt.de
(35539199)
Comments: Getting ready to quit mozilla  closeing all windows.  Got to last one
 and crash.
     (35532697)	URL: www.cnet.com
(35532697)
Comments: right clicking on link
     (35530999)	URL: http://astalavista.box.sk
(35520075)
Comments: downloading stuff
     (35513148)	URL: astalavista.box.sk
     (35513148)	Comments: i set the user_pref ("dom.disable_open_during_load"  true) and
went to this site to test it (lots o' popups....). got all the popups and then a
crash to boot.
     (35511679)	Comments: i browsed to astalavista.box.sk . a popup opened .. the browser
crashed
     (35487174)	URL: http://www.thinkgeek.com/stuff/fun-stuff/2a01.shtml
(35441332)
URL: sports.espn.go.com/mlb/standings
     (35441332)	Comments: Clicking reload
     (35436975)	Comments: right-clicked mouse  then clicked to close a pop-up window = crash
     (35426673)	Comments: browsing in several windows. (10+)..
     (35419336)	URL: www.hotmail.com
(35419336)
Comments: I was testing the search tab on the sidebar.
     (35415358)	URL: http://astalavista.box.sk
(35415358)
Comments: Probably when opening astalavista via personal toolbar  the 2
window.open from the site crashed mozilla. Two windows in background tried to
load from the very slow site http://www.codemasters.com
(35409004)
Comments: I reloaded a page whilie it was loading  involved with a lot of
javascript.
     (35404218)	Comments: trying to add address book to sidebar.  Just double clicked
"address book" in "customize sidebar"

This is also a topcrasher for N610, but I won't bother posting any data for that
release, since the M094 data should be enough and most up to date.

Comment 6

[Nisheeth Ranjan]

Re-assigning to Heikki as Johnny is on vacation.  We should try to fix this one.

Comment 7

[Nisheeth Ranjan]

... if we can reproduce it.  I tried to reproduce this from a couple of the
talkback comments and was unable to.

Comment 8

[Heikki Toivonen (remove -bugzilla when emailing directly)]

It looks like the crash might happen because we don't have a document, and try
to access it -> KABOOM! Other code in the class seems to check mDocument first,
so they avoid these crash conditions. I have a simple null check to prevent
this, but  I don't know if we are beyond help at this point.

Vidur is the original author, Cc him & jst for comments. Attaching patch.

Comment 9

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Attachment: Null check to possibly prevent this crash

Comment 10

[lchiang]

let's mark this nsbranch+ to get on PDT radar since you are close to a fix. 
Thank you.

Comment 11

[vidur (gone)]

Comment on attachment 50704 [details] [diff] [review]
Null check to possibly prevent this crash

A very reasonable (and safe) null check.

Comment 12

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Checked in on trunk, leaving open to attract PDT...

Comment 13

[Jaime Rodriguez, Jr.]

check it in - PDT+

Comment 14

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Fixed on the branch as well, closing.

Comment 15

[Sivakiran Tummala]

loaded all the url's in question here and tried to reproduce the bug. tested on
win 98 09-26-05 build did not crash. marking as verified

Comment 16

[Robert Seifert]

Ah ! Greatness! :))

Comment 17

[Heikki Toivonen (remove -bugzilla when emailing directly)]

jpatel: could you check the talkback database and see if this stack trace has
disappeared? This was fixed on 9/25 (trunk & 0.9.4).

Comment 18

[Jay Patel [:jay]]

The last crash on the MozillaTrunk was with build 2001092114 and the last crash
on the M094/N620 branch was with build 2001092405.  Marking verified.