186805 - Running "linked images" bookmarklet crashes the browser

Status: VERIFIED DUPLICATE of bug 119693

(Core :: Graphics: ImageLib, defect)

Description

[gavin long]

WinXP, 2002122508 trunk.

Running this bookmarklet crashes the browser:

javascript:(function(){var x,z,i; function linkIsSafe(u) { if
(u.substr(0,7)=='mailto:') return false; if (u.substr(0,11)=='javascript:')
return false; return true; } function linkIsImage(u) { var spd, ext;
spd=u.split('.'); if (spd.length > 0) { ext = spd[spd.length-1].toLowerCase();
if (ext=='gif' || ext=='jpg' || ext=='png' || ext=='mng') return true; } return
false; } function
htmlEscape(s){s=s.replace(/&/g,'&amp;');s=s.replace(/>/g,'&gt;');s=s.replace(/</g,'&lt;');return
s;} z = window.open().document; z.writeln('<p>Images linked to by ' +
htmlEscape(location.href) + ':</p><hr>'); x = document.links; for (i = 0; i <
x.length; ++i) if(linkIsSafe(x[i].href) && linkIsImage(x[i].href))
z.writeln('<img src="' + x[i].href.replace(/"/g, '&quot;') + '">');
z.writeln('<hr>'); z.close(); })();

Talkback: TB15493985M, TB15493959Z

Comment 1

[gavin long]

Oops.  Not quite as easy to reproduce as I thought, but nearly.

Steps to reproduce:
1. go to www.mozilla.org
2. run the above bookmarklet
3. boom!

Comment 2

[Matthias Versen [:Matti]]

Can you attach the bookmarklet as file ?
You have linebreaks here and I get a JS error if I remove this linebreaks.

Comment 3

[Olivier Cahagne]

I don't crash using build 20021220 and build 20021226 on Linux, however, the
script doesn't seem to work well as I only see a line of text 'Images linked to
by www.mozilla.org' + 2 <hr> and no images or URLs. No warning whatsoever in
JavaScript console or linux debug build console.
Will try again, I guess some chars were mangled by the copy'n'paste process.

Comment 4

[gavin long]

Attachment: The bookmarklet, as text

The bookmarklet generates a page of <img> tags containing images linked to by
the page you are viewing.  It's intended for thumbnail galleries, so
mozilla.org is not the best page to use it on to see it in all its glory.  It's
good enough to crash me, though.

Comment 5

[Matthias Versen [:Matti]]

Thanks for the script, it seem to work now but I get the same result as Oliver and 
no crash..
(2 day old win2k trunk)

Comment 6

[gavin long]

I'm not crashing with 2002121215 (1.3 alpha), but 2002122408 crashes every time,
as do nightlies from the 25th and 27th.  I'll try and narrow it down.

Comment 7

[gavin long]

It doesn't get any narrower: 2002122404 doesn't crash, 2002122408 does.  If we
can get a stack trace, that ought to give someone a clue...

Comment 8

[gavin long]

The timing suggests that this is *not* a duplicate of bug 186752 (based on
dbaron's comment at http://bugzilla.mozilla.org/show_bug.cgi?id=46814#c26 that
those crashes started showing up in 12/23 builds)

At this point, I think I should stop being impatient and wait for the stack trace...

Comment 9

[Olivier Cahagne]

only checkin between 2002122404 and 2002122408: bug 137819.
CC'ing Christian Biesinger although I'm unsure how it's related.

Comment 10

[Simon Montagu :smontagu]

Stacktrace of both TB ids:

PR_EnterMonitor [prmon.c, line 93]
PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c,
line 572]
USER32.dll + 0x27ad7 (0x77d67ad7)
0x5e20468

Comment 11

[Christian :Biesinger (don't email me, ping me on IRC)]

stack traces sound like a duplicate to me, marking as such

*** This bug has been marked as a duplicate of 119693 ***

Comment 12

[Matthias Versen [:Matti]]

v dupe