225537 - Crash if I call a parameter as function but no parameter passed

Status: VERIFIED DUPLICATE of bug 224956

(Core :: JavaScript Engine, defect)

Description

[zhanglu]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6a) Gecko/20031030
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6a) Gecko/20031030

when a javascript function takes parameter as function, but no parameter passed
call this parameter, mozilla will crash

Reproducible: Always

Steps to Reproduce:
1.load the page attached
2.press crash button

Actual Results:  
crash

Expected Results:  
nothing should happed

Comment 1

[zhanglu]

Attachment: use for reproduce bug

Comment 2

[Bryan]

Hi,
It looks like that it only happens in windows xp.

Comment 3

[Olivier Cahagne]

wfm 20031111 Win2k, can you post a Talkback ID for this crash
"mozilla/components/talkback.exe" ?

Comment 4

[Hermann Schwab]

TB25517789G
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031028

crashes in Win98 too, also with newer versions of Mozilla, but that one did have
talkback and was a official one.

Comment 5

[Phil Schwartau]

Here is the stack trace from TB25517789:

js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 690]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2934]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 930]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2934]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 930]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 1007]
JS_CallFunctionValue [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3573]
nsJSContext::CallEventHandler
[c:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1222]
nsJSEventListener::HandleEvent
[c:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 182]
nsEventListenerManager::HandleEventSubType
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1423]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1500]
nsGenericElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp, line 1966]
nsHTMLInputElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 1435]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6186]
PresShell::HandleEventWithTarget
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6142]
nsEventStateManager::CheckForAndDispatchClick
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 2913]
nsEventStateManager::PostHandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 1902]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6240]
PresShell::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6111]
nsViewManager::HandleEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2299]
nsView::HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 298]
nsViewManager::DispatchEvent
[c:/builds/seamonkey/mozilla/view/src/nsViewManager.cpp, line 2042]
HandleEvent [c:/builds/seamonkey/mozilla/view/src/nsView.cpp, line 79]
nsWindow::DispatchEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1054]
nsWindow::DispatchWindowEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1071]
nsWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5198]
ChildWindow::DispatchMouseEvent
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 5453]
nsWindow::ProcessMessage
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 4032]
nsWindow::WindowProc
[c:/builds/seamonkey/mozilla/widget/src/windows/nsWindow.cpp, line 1334]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00658b66

Comment 6

[Phil Schwartau]

I believe this is a duplicate of bug 224956,
"Crash if implied multiplication used in JavaScript statement"

That was fixed on 2003-11-08. Zhanglu, can you try an up-to-data
build and see if you still crash?

OOPS! ftp://ftp.mozilla.org/pub/mozilla.org/mozilla/nightly/latest/
doesn't show any Windows build later than 2003-10-28 !!!

Let me try to find out why -

Comment 7

[Phil Schwartau]

Phil Schwartau wrote:

> Hi Asa,
>
>ftp://ftp.mozilla.org/pub/mozilla.org/mozilla/nightly/latest/
>doesn't show any Windows build later than 2003-10-28 !!!
>
>Any idea why? There are some bugs that need up-to-date
>builds for verification. Am I going to the wrong site?
>
>Thanks,
>Phil
> 
>
>
We're working on it. You can get windows and linux builds from
http://ftp.mozilla.org/pub/mozilla.org/mozilla/tinderbox-builds/ for
now. Leaf's not quite finished with the automation that will have
tinderboxes spitting out builds regularly and so they're going to the
tinderbox-builds dir until we get the last of the details worked out.

--Asa

Comment 8

[Phil Schwartau]

I'm going to go ahead and mark this bug as a duplicate of bug 224956,
since the syntax causing the two crashes is the same.

Zhanglu, can you try an up-to-date build from the site given in
Comment #7 and see if you still crash? If not, please mark this
bug "Verified". 

If you still get the crash, however, please reopen this bug - thanks.

*** This bug has been marked as a duplicate of 224956 ***

Comment 9

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6b) Gecko/20031113

crashed on the same computer in my comment #4 using
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031028

Comment 10

[zhanglu]

i got new binary here
http://ftp.mozilla.org/pub/mozilla.org/mozilla/tinderbox-builds/2003-11-12-09/mozilla-win32-installer.exe

not crash now

Comment 11

[Bryan]

Hi,.
IO got this stack trace form it.
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 690]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2934]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 930]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2934]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 930]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 1007]
JS_CallFunctionValue [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3573]
nsJSContext::CallEventHandler
[c:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1222]
nsJSEventListener::HandleEvent
[c:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 182]
nsEventListenerManager::HandleEventSubType
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1423]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1500]
nsGenericElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/base/src/nsGenericElement.cpp, line 1966]
nsHTMLInputElement::HandleDOMEvent
[c:/builds/seamonkey/mozilla/content/html/content/src/nsHTMLInputElement.cpp,
line 1435]
PresShell::HandleEventInternal
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6186]
PresShell::HandleEventWithTarget
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6142]
nsEventStateManager::CheckForAndDispatchClick
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 2913]
nsEventStateManager::PostHandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventStateManager.cpp, line 1902]

Incomplete from comment #5

Comment 12

[Phil Schwartau]

Thanks, everyone!

It shows this bug was indeed the same one as bug 224956, which is now fixed.