146505 - Browser crashes while loading www.westvseast.de.vu

Status: VERIFIED DUPLICATE of bug 136761

(Core Graveyard :: Plug-ins, defect)

Description

[Felix Nenz]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc2)
Gecko/20020510
BuildID:    2002051006

When you try to access the page: www.westvseast.de.vu the browser crashes and
all Browser Windows will be closed. It seems to be a problem with the used
javascript code. 

Reproducible: Always
Steps to Reproduce:
1. open www.westvseast.de.vu


Actual Results:  The Browser crashes with

Expected Results:  Should load the page

SCRIPT LANGUAGE="JavaScript">
<!--
var agt=navigator.userAgent.toLowerCase();
var is_major=parseInt(navigator.appVersion);
var is_minor=parseFloat(navigator.appVersion);
var
is_nav=((agt.indexOf('mozilla')!=-1)&&(agt.indexOf('spoofer')==-1)&&(agt.indexOf('compatible')==-1)
&& (agt.indexOf('opera')==-1)&&(agt.indexOf('webtv')==-1));
var is_ie=(agt.indexOf('msie')!=-1);
if(is_ie){var agt_ie=agt.substring(agt.indexOf('msie')+5);
is_major=parseInt(agt_ie); is_minor=parseFloat(agt_ie);}
var is_dom2=(document.getElementById);
var is_http=(window.location.protocol.indexOf('http')==0);
function jsStop( o ) { if(is_ie&&is_major>=4&&eval('document.'+o)){var
e=eval('document.'+o);if(e.src&&e.src!=''&&e.ReadyState&&e.ReadyState>=4){e.stop();}}else{if(is_nav&&is_major>=3&&(is_major<4||eval('document.'+o))){eval('document.'+o+'.stop()');}}
}
function jsPlay( o ) { if(is_ie&&is_major>=4&&eval('document.'+o)){var
e=eval('document.'+o);if(e.src&&e.src!=''&&e.ReadyState&&e.ReadyState>=4){if(is_major>=5){e.play();}else{e.run();}}}else{if(is_nav&&is_major>=3&&(is_major<4||eval('document.'+o))){eval('document.'+o+'.play(false)');}}
}

// Browser detect
if( is_minor < 3.5 )
   alert( "This page will not function properly in your browser.\n\nYour browser
is very old.  Please upgrade your browser to version 4 or later.\n\nOr request
the webmaster (of this page) to change their browser compatibility setting in
Cool Page to version 3 browsers." );
else
{
   if( is_nav && is_minor < 5.0 )
      window.location.replace( 'index_nn4.html' + window.location.search );
}

function Link3Dize()
{
   if( confirm( "This page created with FREE version Cool Page.\n\nDownload your
own FREE copy of Cool Page?\n\nClick Cancel to follow the link instead.  Note
FREE version of Cool Page shows this popup message after 30 days of use.  Buy
Cool Page to make this popup go away." ) )
      window.open( "http://3Dize.com/?aid=PgMadeWithCP", "3Dize" );
   return true;
}
//-->
</SCRIPT>

<!--
function setparam62972()
{
var current = new
Array("swfbgcolor","swfurl","swftype","swftarget","swfsize","swftext","swffile");
current["swfbgcolor"] = "1";
current["swfurl"] = "";
current["swftype"] = "0";
current["swftarget"] = "_blank";
current["swfsize"] = "0";
current["swftext"] = "WEST VS. EAST";
current["swffile"] = "Flare_SWFlet_Logo.gif";
window.document.swfmovie62972.SetVariable("textfx",current["swftext"]);
window.document.swfmovie62972.SetVariable("mywebsite",current["swfurl"]);
window.document.swfmovie62972.SetVariable("tarvar",current["swftarget"]);
}
//-->
</SCRIPT>

Comment 1

[Sander]

I was able to reproduce once - no crashes on subsequent tries.
The problem seems to be caused by the popup created in the onUnload from the
hidden frame in that page - http://w07.net/www.nic.de.vu/zp.html - not allowing
sites to open unrequested windows keeps you safe.


The javascript code on that page is:
<script>
// (c) sektion.de
var theURL = "ad_popup.html";
var theNSURL ="http://w07.net/www.nic.de.vu/popup.html";
var title = "de|nic|vu - Kostenlose Domains f&uuml;r alle!"
var winWidth  = 478;
var winHeight = 100;
var posX = 100;
var posY = 100;
var autocenter = false;//or: true

var ie="width="+winWidth+",height="+winHeight;
var
ns="location=no,menubar=no,statusbar=yes,scrollbars=yes,dependent=yes,width=470,height=32,screenX=-100,screenY=-100";

var beIE=document.all?true:false;
var done=new Object("no");
if(autocenter){posX = (window.screen.width-winWidth)/2;posY =
(window.screen.height-winHeight)/2;}

function ap(){
  if (beIE){
  AdPopUp = window.open("","AdPop","fullscreen,"+ie);
  AdPopUp.blur(); window.focus();
  AdPopUp.resizeTo(winWidth,winHeight);
  AdPopUp.moveTo(posX,posY);
  var frameString=""+
"<html><head><title>"+title+"</title></head>"+
"<frameset rows='*,0' framespacing=0 border=0 frameborder=0>"+
"<frame name='top' src='"+theURL+"' scrolling=no>"+
"<frame name='bottom' src='about:blank' scrolling='no'>"+
"</frameset></html>"
  AdPopUp.document.open();
  AdPopUp.document.write(frameString);
  AdPopUp.document.close();
  }else{
  AdPopUp=window.open(theNSURL,'_blank',ns);
  AdPopUp.blur(); window.focus();
  AdPopUp.resizeTo(winWidth,winHeight);
  AdPopUp.moveTo(posX,posY);
  }
  AdPopUp.blur();
}
</script>
</head>
<body onunload="ap()">
</body>

Comment 2

[Matthias Versen [:Matti]]

We need a stack trace to be sure that this is JS Engine:

Reporter: Can you post a talkback ID from this crash ?

Comment 3

[Felix Nenz]

now the talkback worked. The Talkback ID is TB6603978Q

Comment 4

[joakim_46]

I think the bug is Flash related, because I don't have Flash plug-in installed 
and the page didn't made Mozilla crash.

Comment 5

[Phil Schwartau]

Here is the Talkback incident mentioned above. Unfortnately, 
the stack trace has only one line:

Incident ID       6603978
Stack Signature   QuickTimeInternetExtras.qtx + 0x7d934 (0x66ded934) 6e3d2062
Product ID        Gecko1.0
Build ID          2002051008
Trigger Time      2002-05-23 14:21:38
Platform          Win32
Operating System  Windows NT 5.0 build 2195
Module            QuickTimeInternetExtras.qtx
URL visited       http://www.westvseast.de.vu
User Comments
Trigger Reason    Access violation
Source File Name
Trigger Line No.
Stack Trace       QuickTimeInternetExtras.qtx + 0x7d934 (0x66ded934) 

Comment 6

[Phil Schwartau]

I had no trouble loading the site with Mozilla trunk binary 2002052008
on WinNT. I did see this error in the JavaScript Console, however:

Error: window.document.swfmovie62972.SetVariable is not a function
Source File: http://people.freenet.de/rappage/
Line: 82


Because of this, and the crash at the QuickTime code above, 
reassigning to Plug-ins for further triage. This is not a 
JavaScript Engine bug -

Comment 7

[rubydoo123]

I accessed the URL, no crash and no problems rendering the page. I did get the
annoying CoolPage popup several times. I did not get any js console errors either.

I am using the current branch builds from today on win98. Shrir -- can you
reproduce this?

Comment 8

[Felix Nenz]

Hi, using Mozilla 2002052508 with Windows 2000 (Quicktime and Flash installed)
and everytime i visit this page it crashes. It is not that i'm so keen on this
page, but mozilla should bring an error but not crash completele becouse of
"nasty" js or html. New Talkback ID is TB67800005H.

Comment 9

[shrirang khanzode]

http://bugzilla.mozilla.org/show_bug.cgi?id=136761

has the same trace (qktimeinternetextras)

*** This bug has been marked as a duplicate of 136761 ***

Comment 10

[shrirang khanzode]

and..oh..btw, I could not repro the crash.

Comment 11

[shrirang khanzode]

btw, qktime has a new qktime6 preview available. Felix, can u try using that 
and see if this might have gotten fixed with this new version? Thx!

http://www.apple.com/quicktime/preview/quicktime6/