114859 - Crash executing JS reading yahoo mail

Status: VERIFIED DUPLICATE of bug 110653

(Core :: DOM: Core & HTML, defect)

Description

[Mike Pinkerton (not reading bugmail)]

I was at my.yahoo reading my yahoo webmail with the 12/11/01 OSX build and got
this crash when i clicked the "check mail" link:

Thread 0:
 #0   0x00592ab8 in _pool_free
 #1   0x40000000 in 0x40000000
 #2   0x00592e20 in free
 #3   0x027a7e80 in js_strtod
 #4   0x027cd690 in 0x27cd690
 #5   0x027c26e8 in UnaryExpr
 #6   0x027c231c in MulExpr
 #7   0x027c221c in AddExpr
 #8   0x027c214c in ShiftExpr
 #9   0x027c2024 in RelExpr
 #10  0x027c1f64 in EqExpr
 #11  0x027c1e68 in BitAndExpr
 #12  0x027c1d88 in BitXorExpr
 #13  0x027c1ca8 in BitOrExpr
 #14  0x027c1bd8 in AndExpr
 #15  0x027c1b08 in OrExpr
 #16  0x027c196c in CondExpr
 #17  0x027c178c in AssignExpr
 #18  0x027c163c in Expr
 #19  0x027be6ec in Condition
 #20  0x027bf120 in 0x27bf120
 #21  0x027be498 in Statements
 #22  0x027bd5c4 in FunctionBody
 #23  0x027bdda8 in 0x27bdda8
 #24  0x027be36c in FunctionStmt
 #25  0x027bf09c in 0x27bf09c
 #26  0x027be498 in Statements
 #27  0x027bd100 in js_CompileTokenStream
 #28  0x02765618 in CompileTokenStream
 #29  0x027659cc in JS_CompileUCScriptForPrincipals
 #30  0x02766e2c in JS_EvaluateUCScriptForPrincipals
 #31  0x03707ff8 in nsJSContext::EvaluateString(nsAString const &, void *,
nsIPrincipal *, char const *)
 #32  0x0342b4a8 in EvaluateScript__14nsScriptLoaderFP19nsScriptLoadRequestRC13nsA
 #33  0x0342a8d4 in nsScriptLoader::ProcessRequest(nsScriptLoadRequest *)
 #34  0x0342a134 in ProcessScriptElement__14nsScriptLoaderFP23nsIDOMHTMLScriptElem
 #35  0x0317c208 in nsHTMLScriptElement::SetDocument(nsIDocument *, int, int)
 #36  0x030d5d98 in nsGenericHTMLContainerElement::AppendChildTo(nsIContent *,
int, int)
 #37  0x02febe58 in HTMLContentSink::ProcessSCRIPTTag(nsIParserNode const &)
 #38  0x02fe1ae0 in HTMLContentSink::AddLeaf(nsIParserNode const &)
 #39  0x0296a6bc in CNavDTD::AddLeaf(nsIParserNode const *)
 #40  0x02966ff8 in CNavDTD::HandleScriptToken(nsIParserNode const *)
 #41  0x02969b8c in OpenContainer__7CNavDTDFPC13nsCParserNode9nsHTMLTagiP12nsEntry
 #42  0x029643d8 in HandleDefaultStartToken__7CNavDTDFP6CToken9nsHTMLTagP13nsCPars
 #43  0x0296589c in CNavDTD::HandleStartToken(CToken *)
 #44  0x0296321c in CNavDTD::HandleToken(CToken *, nsIParser *)
 #45  0x02961ba8 in BuildModel__7CNavDTDFP9nsIParserP12nsITokenizerP16nsITokenObse
 #46  0x029921b0 in nsParser::BuildModel(void)
 #47  0x02991e2c in nsParser::ResumeParse(int, int)
 #48  0x02990e60 in nsParser::ContinueParsing(void)
 #49  0x0299100c in nsParser::HandleParserContinueEvent(void)
 #50  0x0298d6b8 in HandlePLEvent(nsParserContinueEvent *)
 #51  0x00670ec8 in PL_HandleEvent
 #52  0x00670c60 in PL_ProcessPendingEvents
 #53  0x005f411c in nsEventQueueImpl::ProcessPendingEvents(void)
 #54  0x02a4e7a8 in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void)
 #55  0x02a4e178 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &)
 #56  0x010b4bb0 in Repeater::DoRepeaters(EventRecord const &)
 #57  0x02a67b14 in nsMacMessagePump::DispatchEvent(int, EventRecord *)
 #58  0x02a67658 in nsMacMessagePump::DoMessagePump(void)
 #59  0x02a66de0 in nsAppShell::Run(void)
 #60  0x029f69b8 in nsAppShellService::Run(void)
 #61  0x004e4f88 in main1(int, char **, nsISupports *)
 #62  0x004e7644 in main

alas, I can't reproduce it now, but shaver told me to file it anyway.

Comment 1

[Phil Schwartau]

Reassigning to Kenton. Note test account at http://mail.yahoo.com:

         [Test account ID: mozdebug  Password: mozilla]

Comment 2

[Phil Schwartau]

This is a duplicate of bug 110653, also filed against Mac OSX:
"Browser crashes when clicking "Check Mail" in Yahoo mail"
Changing component to Form Submission for parity with dupe - 

Comment 3

[Phil Schwartau]

*** This bug has been marked as a duplicate of 110653 ***

Comment 4

[Vladimir Ermakov]

verifying