226766 - Crash loading XUL script [@js_ValueToBoolean]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Charles Fenwick]

Per Brendan's request in bug 214043, a new bug is created.

Crash occurred by clicing on Tools>Search Addresses in MailNews.

#0  0x40712fa6 in nanosleep () from /lib/i686/libc.so.6
#1  0xffffffd8 in ?? ()
#2  0x40712dd7 in sleep () from /lib/i686/libc.so.6
#3  0x08078a6e in ah_crap_handler(int) (signum=11)
    at ../../../moz/mozilla/xpfe/bootstrap/nsSigHandlers.cpp:135
#4  0x42a223b6 in nsProfileLock::FatalSignalHandler(int) (signo=11)
    at
../../../../moz/mozilla/profile/dirserviceprovider/src/nsProfileLock.cpp:195
#5  0x4013b96c in __pthread_sighandler () from /lib/i686/libpthread.so.0
#6  <signal handler called>
#7  0x4003aad6 in js_ValueToBoolean (cx=0x8fef198, v=-623191334,
bp=0xbfffe6dc)
    at ../../../moz/mozilla/js/src/jsbool.c:227
#8  0x40065c0a in js_Interpret (cx=0x8fef198, result=0xbfffe82c)
    at ../../../moz/mozilla/js/src/jsinterp.c:1673
#9  0x4006423d in js_Execute (cx=0x8fef198, chain=0x8ffcd18,
script=0x8cd93d8,
    down=0x0, special=0, result=0xbfffe82c)
    at ../../../moz/mozilla/js/src/jsinterp.c:1146
#10 0x40032f2b in JS_ExecuteScript (cx=0x8fef198, obj=0x8ffcd18,
    script=0x8cd93d8, rval=0xbfffe82c)
    at ../../../moz/mozilla/js/src/jsapi.c:3418
#11 0x41f014b1 in nsJSContext::ExecuteScript(void*, void*, nsAString*,
int*) (
    this=0x8ed2a10, aScriptObject=0x8cb1af8, aScopeObject=0x8ffcd18,
    aRetValue=0x0, aIsUndefined=0x0)
 at ../../../../moz/mozilla/dom/src/base/nsJSEnvironment.cpp:1036
#12 0x415312c3 in nsXULDocument::ExecuteScript(JSObject*) (this=0x928efa8,
    aScriptObject=0x8cb1af8)
    at
../../../../../moz/mozilla/content/xul/document/src/nsXULDocument.cpp:3414
#13 0x41530824 in nsXULDocument::LoadScript(nsXULPrototypeScript*, int*) (
    this=0x928efa8, aScriptProto=0x8921350, aBlock=0xbfffea3c)
    at
../../../../../moz/mozilla/content/xul/document/src/nsXULDocument.cpp:3180
#14 0x4152f886 in nsXULDocument::ResumeWalk() (this=0x928efa8)
    at
../../../../../moz/mozilla/content/xul/document/src/nsXULDocument.cpp:2945
#15 0x41531032 in nsXULDocument::OnStreamComplete(nsIStreamLoader*,
nsISupports*, unsigned, unsigned, char const*) (this=0x928efa8,
aLoader=0x0, context=0x0,
    aStatus=0, stringLen=7453,
    string=0x9250410 "/* -*- Mode: Java; tab-width: 4; indent-tabs-mode:
nil; c-basic-offset: 4 -*- */\n/* ***** BEGIN LICENSE BLOCK *****\n *
Version: NPL 1.1/GPL 2.0/LGPL 2.1\n *\n * The contents of this file are
subject to "...)
    at
../../../../../moz/mozilla/content/xul/document/src/nsXULDocument.cpp:3364
#16 0x4259de37 in nsStreamLoader::OnStopRequest(nsIRequest*, nsISupports*,
unsigned) (this=0x9168468, request=0x9168748, ctxt=0x0, aStatus=0)
    at ../../../../moz/mozilla/netwerk/base/src/nsStreamLoader.cpp:141
#17 0x4264b808 in nsJARChannel::OnStopRequest(nsIRequest*, nsISupports*,
unsigned) (this=0x9168748, req=0x9014bb0, ctx=0x0, status=0)
    at
../../../../../moz/mozilla/netwerk/protocol/jar/src/nsJARChannel.cpp:654
#18 0x42573d38 in nsInputStreamPump::OnStateStop() (this=0x9014bb0)
    at ../../../../moz/mozilla/netwerk/base/src/nsInputStreamPump.cpp:498
#19 0x42573755 in
nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) (
    this=0x9014bb0, stream=0x9014c3c)
    at ../../../../moz/mozilla/netwerk/base/src/nsInputStreamPump.cpp:339
#20 0x40a80321 in nsInputStreamReadyEvent::EventHandler(PLEvent*) (
    plevent=0x91309b4) at
../../../moz/mozilla/xpcom/io/nsStreamUtils.cpp:116
#21 0x40aa587c in PL_HandleEvent (self=0x91309b4)
    at ../../../moz/mozilla/xpcom/threads/plevent.c:671
#22 0x40aa571d in PL_ProcessPendingEvents (self=0x81755f8)
    at ../../../moz/mozilla/xpcom/threads/plevent.c:606
#23 0x40aa7d80 in nsEventQueueImpl::ProcessPendingEvents()
(this=0x8173e50)
    at ../../../moz/mozilla/xpcom/threads/nsEventQueue.cpp:391
#24 0x41af9c3c in event_processor_callback (source=0x438049e0,
    condition=G_IO_IN, data=0x8173e50)
    at ../../../../moz/mozilla/widget/src/gtk2/nsAppShell.cpp:67
#25 0x40555def in g_io_unix_dispatch () from
/opt/gnome/lib/libglib-2.0.so.0
#26 0x40533148 in g_main_dispatch () from /opt/gnome/lib/libglib-2.0.so.0
#27 0x405341a8 in g_main_context_dispatch ()
   from /opt/gnome/lib/libglib-2.0.so.0
#28 0x405345a8 in g_main_context_iterate ()
   from /opt/gnome/lib/libglib-2.0.so.0
#29 0x40534bf7 in g_main_loop_run () from /opt/gnome/lib/libglib-2.0.so.0
#30 0x402576ff in gtk_main () from /opt/gnome/lib/libgtk-x11-2.0.so.0
#31 0x41afa33a in nsAppShell::Run() (this=0x81b3750)
    at ../../../../moz/mozilla/widget/src/gtk2/nsAppShell.cpp:142
#32 0x4210437b in nsAppShellService::Run() (this=0x81b3708)
    at ../../../../moz/mozilla/xpfe/appshell/src/nsAppShellService.cpp:483
#33 0x0806f747 in main1 (argc=1, argv=0xbffff194, nativeApp=0x815e3c0)
    at ../../../moz/mozilla/xpfe/bootstrap/nsAppRunner.cpp:1291
#34 0x08070233 in main (argc=1, argv=0xbffff194)
    at ../../../moz/mozilla/xpfe/bootstrap/nsAppRunner.cpp:1678

Comment 1

[Brendan Eich [:brendan]]

Who else can reproduce this bug?

/be

Comment 2

[David :Bienvenu]

doesn't seem to happen on windows...

Comment 3

[Charles Fenwick]

Unfortunately, I do not have a build enviroment on Windows, but  maybe someone
can make something of this:

I downloaded 2003112508 and installed it.  After it opened after the
installation completed, I opened MailNews and clicked on Tools>Search Addresses
and I got the Microsft "Program has encountered a problem..." dialog
(Modname:js3250.dll).
Restarted and repeated the process with the same results.  Restarted again and
did Tools>Search Messages.  Closed the box and did Tools>Search Addresses.  No
crash (even after repeated attempts).

Comment 4

[Brendan Eich [:brendan]]

Do you have enigmail or any other extensions installed?

/be

Comment 5

[Charles Fenwick]

No.  It's completely stock (no modifications/additions).

Comment 6

[tenthumbs]

My Nov. 22 Linux debug trunk mozilla build also crashes with a similar
backtrace.

Comment 7

[tenthumbs]

Attachment: stack trace

Comment 8

[tenthumbs]

But in this morning's build no crash but this instead.

JavaScript error:
chrome://messenger/content/mailCommands.js line 423: redeclaration of const 
NS_BAYESIANFILTER_CONTRACTID

JavaScript error:
chrome://messenger/content/msgViewPickerOverlay.js line 23: redeclaration of 
const kPersonalAddressbookURI

JavaScript error:
chrome://help/content/contextHelp.js line 21: redeclaration of const 
MOZILLA_HELP

************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "'[JavaScript Error: "textZoomMenu has no properties" {file: 
"chrome://communicator/content/viewZoomOverlay.js" line:
229}]' when calling method: [nsIDOMEventListener::handleEvent]"  nsresult: 
"0x80570021 (NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS)"  location: 
"<unknown>"  data: yes]
************************************************************
JavaScript error:
chrome://messenger/content/mailWidgets.xml line 1520: menulist.selectedItem 
has no properties

Comment 9

[Brendan Eich [:brendan]]

Sounds like this may also be a dup of bug 225423.

/be

Comment 10

[Brendan Eich [:brendan]]

tenthumbs: regarding

JavaScript error:
chrome://messenger/content/mailWidgets.xml line 1520: menulist.selectedItem 
has no properties

and possibly all the other errors that seemed new in that morning's build, see
bug 224549 and its followup bug 227013.

Is anyone able to reproduce this bug?  Reporter, can you try a recent build?

/be

Comment 11

[Charles Fenwick]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6b) Gecko/20031130 crashes
under the same circumstances as outlined in comment 3.

Comment 12

[Brendan Eich [:brendan]]

Can anyone (David, Scott, Seth?) get Charles a debug build, or at least point
him to a talkback XPI for a nightly (leaf)?  caillon or jrgm can get us the
talkback, if it makes it thru to a netscape.com server.

/be

Comment 13

[Charles Fenwick]

As I do not see this crash on 1.7b, am resolving this as WFM...