106345 - Browser crashes on load of page w/javascript code [@JS_ArenaRealloc ()]

Status: VERIFIED DUPLICATE of bug 106568

(Core :: JavaScript Engine, defect)

Description

[Peter O'Shea]

Trying the latest Solaris 2.6 nightly build (2001012222), the browser window
crashes after the window loads, but before the home page is loaded.  This is
running on Solaris 8 on an ultrasparc.  Backtrace follows:

Program received signal SIGBUS, Bus error.
0xff2968e4 in JS_ArenaRealloc ()
(gdb) bt
#0  0xff2968e4 in JS_ArenaRealloc ()
#1  0xff2cca7c in js_SetRequiredSlot ()
#2  0xff2ccb6c in js_SetRequiredSlot ()
#3  0xff2cd15c in js_printf ()
#4  0xff2ce720 in js_puts ()
#5  0xff2d0cf8 in js_DecompileCode ()
#6  0xff2d0da4 in js_DecompileScript ()
#7  0xff2d1090 in js_DecompileFunction ()
#8  0xff295944 in JS_DecompileFunction ()
#9  0xff2b1a50 in js_SetCallVariable ()
#10 0xff2b1abc in js_SetCallVariable ()
#11 0xff2b5880 in js_Invoke ()
#12 0xff2b5ae4 in js_InternalInvoke ()
#13 0xff2cc318 in js_TryMethod ()
#14 0xff2e73c4 in js_ValueToSource ()
#15 0xff2cfd6c in js_puts ()
#16 0xff2d0cf8 in js_DecompileCode ()
#17 0xff2d0da4 in js_DecompileScript ()
#18 0xff2d1090 in js_DecompileFunction ()
#19 0xff295944 in JS_DecompileFunction ()
#20 0xff2b1a50 in js_SetCallVariable ()
#21 0xff2b1a94 in js_SetCallVariable ()
#22 0xff2b5880 in js_Invoke ()
#23 0xff2b5ae4 in js_InternalInvoke ()
#24 0xff2cc318 in js_TryMethod ()
#25 0xff2cb0cc in js_DefaultValue ()
#26 0xff2e728c in js_ValueToString ()
#27 0xff291370 in JS_ValueToString ()
#28 0xfd2a7394 in ?? () from /home/poshea/bin/mozilla/components/libjsdom.so
#29 0xfd754eb0 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#30 0xfd754ab8 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#31 0xfd75481c in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#32 0xfd5dd8cc in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#33 0xfd5a7c80 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#34 0xfd602d88 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#35 0xfd5fe460 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#36 0xfe931b58 in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#37 0xfe931cc0 in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#38 0xfe92e640 in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#39 0xfe92caf4 in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#40 0xfe92bd5c in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#41 0xfe93eb00 in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#42 0xfe93e808 in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#43 0xfe93dec8 in ?? () from /home/poshea/bin/mozilla/components/libhtmlpars.so
#44 0xfd6028e4 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#45 0xfd754c68 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#46 0xfd754acc in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#47 0xfd755bf8 in ?? () from /home/poshea/bin/mozilla/components/libgkcontent.so
#48 0xfde6e538 in ?? () from /home/poshea/bin/mozilla/components/libnecko.so
#49 0xfde6dab0 in ?? () from /home/poshea/bin/mozilla/components/libnecko.so
#50 0xfdea2ae0 in ?? () from /home/poshea/bin/mozilla/components/libnecko.so
#51 0xfdebe8f8 in ?? () from /home/poshea/bin/mozilla/components/libnecko.so
#52 0xfde5e064 in ?? () from /home/poshea/bin/mozilla/components/libnecko.so
#53 0xff1a4190 in PL_HandleEvent ()
#54 0xff1a40c0 in PL_ProcessPendingEvents ()
#55 0xff1a5168 in nsEventQueueImpl::ProcessPendingEvents ()
#56 0xfdcfebf4 in ?? () from /home/poshea/bin/mozilla/components/libwidget_gtk.so
#57 0xfdcfe8a8 in ?? () from /home/poshea/bin/mozilla/components/libwidget_gtk.so
#58 0xfee6406c in g_io_unix_dispatch (source_data=0x30ce70,
current_time=0xffbeed48, user_data=0x2fcee0)
    at giounix.c:135
---Type <return> to continue, or q <return> to quit---
#59 0xfee65d48 in g_main_dispatch (dispatch_time=0xffbeed48) at gmain.c:656
#60 0xfee665e4 in g_main_iterate (block=-18301532, dispatch=1) at gmain.c:877
#61 0xfee667f8 in g_main_run (loop=0x2fcef0) at gmain.c:935
#62 0xfefbf940 in gtk_main ()
#63 0xfdcff190 in ?? () from /home/poshea/bin/mozilla/components/libwidget_gtk.so
#64 0xfe8c9c10 in ?? () from /home/poshea/bin/mozilla/components/libnsappshell.so
#65 0x170d0 in NS_CreateNativeAppSupport ()
#66 0x17b3c in main ()

Comment 1

[Peter O'Shea]

Ok, after a bit of additional testing, I've got this narrowed a bit further. 
It's not a startup crasher bug - it's a crasher when it goes to my "home page".
Unfortunately, this page that causes Moz to crash 100% of the time (but not Moz
0.9.3) is a company intranet page.  I'll attach the html source of the page, and
the javascript file that it includes (it's LGPL).  I'm not going to bother with
graphics files, since from the backtrace it looks like it's the javascript code
that's causing the crash.

Comment 2

[Peter O'Shea]

Attachment: HTML source of page that causes crash

Comment 3

[Peter O'Shea]

Attachment: Javascript source called by html

Comment 4

[Jim Crumley]

This is probably the same as bug 106459.  If I had noticed this bug instead of
bug  106412, I probably wouldn't have opened that bug 106459.

Marking as a duplicate, even though this one came first.

*** This bug has been marked as a duplicate of 106459 ***

Comment 5

[Peter O'Shea]

This is definitely not a duplicate of 106459.  Check the backtrace, they're not
similar at all.  I can browse to just about any page without crashing, except
the one page I've submitted in the attachments.  Reopening, and changing the
summary.  Also marking down to "major" because it only affects this one instance.

Comment 6

[timeless]

.

Comment 7

[Phil Schwartau]

Looks same as Solaris stack trace from Jim Crumley in bug 106568.
I will dupe this bug against the other one, because the URL there
is more accessible for debugging purposes.

In this bug, I found I could not load the HTML in attachment 54862 [details].
The JS file in attachment 54863 [details] is only one of the many DynAPI files
the site uses...



*** This bug has been marked as a duplicate of 106568 ***

Comment 8

[Phil Schwartau]

> In this bug, I found I could not load the HTML in attachment 54862 [details].
> The JS file in attachment 54863 [details] is only one of the many DynAPI files
> the site uses...


Clarification: I could LOAD the HTML, but the JS was non-functional
               because so many other JS files are needed at this site.

Comment 9

[Phil Schwartau]

This bug was marked a dupe of bug 105726 via bug 106568.
Bug 105726 has now been marked "Fixed", as of 2001-10-28. 

[e-mail]: could you try a build from 2001-10-29
or later and see if the current bug is fixed? If so, please mark
this bug "Verifed"; otherwise, you can reopen it, thanks -

Comment 10

[Peter O'Shea]

Build from 10/30 works on the page that previously caused the crash.  Marking
verified.