236792 - If i try to search for somethin in google the browser crashes when entering the first letter into the search field [@ nsVoidArray::ElementAt ]

Status: VERIFIED DUPLICATE of bug 248442

(Firefox :: Address Bar, defect)

Description

[Philipp Strube]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3.2; Linux) (KHTML, like Gecko)
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.6) Gecko/20040308 Firefox/0.8

When i enter something into the search field of the google website the brwoser 
crashes and disappears from the screen, or gets unusable. Meaning it still is 
there but I can't use it anymore. 

Reproducible: Always
Steps to Reproduce:
1. go to www.google.de 
2. enter l (actually I try to type linux wlan) 
3. but it crashes with the first letter "l" 
 
Actual Results:  
the browser crashed 

Expected Results:  
let me type in the other letters of my search request 

I am using Gentoo GNU/Linux on an AMD64. I compiled Firefox myself using the 
Firefox ebuild coming with Gentoo. 
I don't have any other problems with crashing software so I don't think it is 
an issue with my hardware.

Comment 1

[Martin Garton]

I can confirm its almost certainly not hardware as I have the same problem, also
on amd64 and also using gentoo.  I'm not using over aggressive optimisations for
compile either.
The crash for me was after entering one character in the search field on
www.google.com

Comment 2

[Martin Garton]

rm -rf  ~/.phoenix and restarting "fixed" this.

It seems to be something to do with the autocompletion of form fields.
Before I deleted .phoenix, it would crash if the first letter entered was "g"
but not for any other I tried.

If it happens again, would it be any use if I sent one of the files? Which file
stores form fields?

Comment 3

[john shimek]

I have the same problem often.  I also have the amd64 running Gentoo linux with
2.6.3 kernel.  Firefox will either crash or sometimes it will just freeze and i
have to kill it manually from the command line.  It seems to happen with
autocompleting in search/input fields.  Mostly on the search box for the gentoo
forums and at google.  And it usually happens when I have search for manythings
with the same name or starting letters.  In other words if i search for
something that starts with the letter "a" often it will crash.  It seems to me
that if there are too many options for autocomplete it will crash.  

I dont think it is my hardware as nothing else crashes like this.  Mozilla
itself does not have this problem

Comment 4

[Olivier Cahagne]

can you attach a stacktrace using GDB ? Run 'firefox -g' then in "GDB>", type
'run' and whe Firefox has crashed and you're in "GDB>", type 'backtrace'

Comment 5

[Joe]

This bug is very annoying.

Here's your stacktrace.  I hope it helps.  I'm using Gentoo.
The Gentoo forums have incorrectly "solved" this bug a number
of times now.  These have been woefully incomplete solutions.
They don't universally fix the problem.  I've turned off auto-complete,
for example, and still the bug is _very_ repeatable.  BUT it's vexing
in that it doesn't happen _every_ time I use google/yahoo/etc.  But I
_easily_ can create a sequence of events that is repeatable and _always_
generates this crash.  However, this same sequence of events doesn't
necessarily crash when using a different login.  Go figure.

This sequence of events used to generate this crash is basically the
same as the original comment of this bug report.

Program received signal SIGSEGV, Segmentation fault.
0x0000002a9e4e5e24 in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libtoolkitcomps.so
(gdb) backtrace
#0  0x0000002a9e4e5e24 in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libtoolkitcomps.so
#1  0x0000002a9588dc21 in NS_QuickSort ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#2  0x0000002a9e4e5c01 in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libtoolkitcomps.so
#3  0x0000002a9e4e2d4b in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libtoolkitcomps.so
#4  0x0000002a9e4cad21 in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libtoolkitcomps.so
#5  0x0000002a9e4ca4fc in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libtoolkitcomps.so
#6  0x0000002a958c5e1d in nsTimerImpl::Fire() ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#7  0x0000002a958c5ed8 in handleTimerEvent(TimerEventType*) ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#8  0x0000002a958c2c49 in PL_HandleEvent ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#9  0x0000002a958c2b97 in PL_ProcessPendingEvents ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#10 0x0000002a958c3a7f in nsEventQueueImpl::ProcessPendingEvents() ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#11 0x0000002a9a6be3ee in nsAFlatString::get() const ()
   from /usr/lib/MozillaFirefox/components/libwidget_gtk2.so
#12 0x0000002a96d32f1b in g_vsnprintf () from /usr/lib/libglib-2.0.so.0
#13 0x0000002a96d1573f in unblock_source () from /usr/lib/libglib-2.0.so.0
#14 0x0000002a96d1664c in g_main_context_dispatch ()
   from /usr/lib/libglib-2.0.so.0
#15 0x0000002a96d16914 in g_main_context_dispatch ()
   from /usr/lib/libglib-2.0.so.0
#16 0x0000002a96d16f1d in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#17 0x0000002a960f8ba0 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#18 0x0000002a9a6be752 in nsAppShell::Run() ()
   from /usr/lib/MozillaFirefox/components/libwidget_gtk2.so
#19 0x0000002a9a0e5d4e in ?? ()
   from /usr/lib/MozillaFirefox/components/libnsappshell.so
#20 0x000000000040ac01 in getCountry(nsAString const&, nsAString&) ()
#21 0x000000000040b5e6 in xre_main(int, char**, nsXREAppData const&) ()
#22 0x0000000000407644 in main ()
(gdb)

Comment 6

[Olivier Cahagne]

your stack is optimized, you'd need a build with debug symbols (built without
--disable-debug)

Comment 7

[Tom Dobes]

This appears to be a duplicate of bug 241068.

Comment 8

[Olivier Cahagne]

*** This bug has been marked as a duplicate of 241068 ***

Comment 9

[David P James]

Umm, guys, how can this be a dupe of bug 241068? This bug was filed on 
2004-03-08 with a build of the same date. The regression that caused bug 
241068 appeared sometime around 2004-04-16. 
 
Please check the dates before jumping to conclusions. It's conceivable that 
the fix to bug 241068 also fixed this, but that would just be a coincidence. 
 
Reporter: are you still seeing this? If not, please resolve as WFM. 

Comment 10

[David P James]

-->Autocomplete 

Comment 11

[Andreas Kunz]

Philipp: are you willing to create a debug build?
And when using a build from Mozilla.org (I assume they work on 64 bit...), does
it also crash and does the talkback crash agent (only included in builds made by
mozilla.org) start? If so please tell us a talback ID.

Comment 12

[Philipp Strube]

(In reply to comment #11) 
> Philipp: are you willing to create a debug build? 
> And when using a build from Mozilla.org (I assume they work on 64 bit...), 
does 
> it also crash and does the talkback crash agent (only included in builds made 
by 
> mozilla.org) start? If so please tell us a talback ID. 
 
I can try to create a debug build myself. The error only shows when using a 
self compiled 64bit version. With the build from mozilla.org and the 
firefox-bin ebuild coming with gentoo, which both seem to be compiled for 32bit 
I only encounter the "Crash on safe password error". Which i guess is a 
different problem. 
I will try to compile a firefox version myself now. I am not an expert and not 
a programmer at all but I can try at least. 
 

Comment 13

[Andreas Kunz]

Setting the 64bit keyword; I hope this is correct.
Philipp:
Help for building is at http://www.mozilla.org/source.html, you can also come to
#mozillazine/#mozilla on irc.mozilla.org or ask me per mail (I'm not on Linux,
though).

Comment 14

[Darren Rigby]

I have a similar crash on Win 98Se. Using "0.9". Clean install. When attempting
to login into Gmail, Firefox 0.9 always crashes just after clicking on login (at
the point when Gmail has finished loading my inbox and before the latter is
displayed. 

I also have the Google search crash (happens from the Google bar and from main
Google search pages. I get to type in my keywords, crash on "enter"). 
Talkback doesn't start when FF crashes although I have enabled the .exe. I get a
Windows error in GDI.exe if this is any help). HTH

Comment 15

[Darren Rigby]

(In reply to comment #14)
Went back to 0.8 and same problem occurred. Resolved problem by deleting a
recently installed pixel font (pixlicons9.fon from
http://www.qxm.de/pixicons/20040423-073604 ). Can now login to Gmail and search
Google.

Comment 16

[Philipp Strube]

Sorry guys, i really tried but i can't manage to build my own firefox. 
What i did is emerge the new 0.9 ebuild coming with gentoo, which still has 
this bug. The prebuild version compiled for 32bit hasn't got it. 
 
If anyone of you can build me a 64bit firefox with talkback enabled i am 
willing to test it. I am more or less just a stupid user, but i am want to 
help! 

Comment 17

[Philipp Strube]

It's me again. :-) 
 
I somehow seemed to mange to build firefox 0.9 with --enable-debug. 
When i start firefox now it throws out much more stuff then before. And there 
also is a message when it crashes. 
 
I hope this is what u need: 
 
bash-2.05b$ firefox -g 
Type Manifest File: /home/logon/.mozilla/firefox/default.2o8/xpti.dat 
nsNativeComponentLoader: autoregistering begins. 
nsNativeComponentLoader: autoregistering succeeded 
nNCL: registering deferred (0) 
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file nsINIParser.cpp, line 51 
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file nsINIParser.cpp, line 51 
 
(firefox-bin:9174): Gtk-WARNING **: Unable to locate theme engine in 
module_path: "qtpixmap", 
 
[ ... this message appeared some more but i think it has something to do with 
the geramik gtk engine, so i deleted most of them ... ] 
 
(firefox-bin:9174): Gtk-WARNING **: Unable to locate theme engine in 
module_path: "qtpixmap", 
 
(firefox-bin:9174): Gtk-WARNING **: Unable to locate theme engine in 
module_path: "qtpixmap", 
GFX: dpi=127 t2p=0.0909091 p2t=11 depth=24 
++WEBSHELL == 1 
++DOMWINDOW == 1 
LoadPlugin: failed to initialize shared 
library /opt/netscape/plugins/libflashplayer.so 
[/opt/netscape/plugins/libflashplayer.so: cannot open shared object file: No 
such file or directory] 
LoadPlugin() /opt/netscape/plugins/libflashplayer.so returned 0 
For application/x-java-vm found 
plugin /opt/blackdown-jdk-1.4.2_rc1/jre/plugin/amd64/mozilla/libjavaplugin_oji.so 
LoadPlugin() /opt/blackdown-jdk-1.4.2_rc1/jre/plugin/amd64/mozilla/libjavaplugin_oji.so 
returned 69a510 
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file nsPermissionManager.cpp, 
line 635 
++WEBSHELL == 2 
++DOMWINDOW == 2 
Note: verifyreflow is disabled 
Note: styleverifytree is disabled 
Note: frameverifytree is disabled 
++WEBSHELL == 3 
++DOMWINDOW == 3 
###!!! ASSERTION: Relative paths not allowed: 'Error', file 
nsLocalFileUnix.cpp, line 272 
Break: at file nsLocalFileUnix.cpp, line 272 
JavaScript error: 
 line 0: uncaught exception: [Exception... "Component returned failure code: 
0x80520001 (NS_ERROR_FILE_UNRECOGNIZED_PATH) [nsILocalFile.initWithPath]"  
nsresult: "0x80520001 (NS_ERROR_FILE_UNRECOGNIZED_PATH)"  location: "JS 
frame :: chrome://browser/content/search.xml :: initialize :: line 31"  data: 
no] 
 
++WEBSHELL == 4 
++DOMWINDOW == 4 
++WEBSHELL == 5 
++DOMWINDOW == 5 
++WEBSHELL == 6 
++DOMWINDOW == 6 
++WEBSHELL == 7 
++DOMWINDOW == 7 
++WEBSHELL == 8 
++DOMWINDOW == 8 
++WEBSHELL == 9 
++DOMWINDOW == 9 
++WEBSHELL == 10 
++DOMWINDOW == 10 
++WEBSHELL == 11 
++DOMWINDOW == 11 
++WEBSHELL == 12 
++DOMWINDOW == 12 
CSS Error (http://www.h-o-l-d.de/Code/Pages/design_navi.css :40.96): Error in 
parsing value for property 'background-position'.  Declaration dropped. 
CSS Error (http://www.h-o-l-d.de/Code/Pages/design_navi.css :41.104): Error in 
parsing value for property 'background-position'.  Declaration dropped. 
CSS Error (http://www.h-o-l-d.de/Code/Pages/design_navi.css :40.96): Error in 
parsing value for property 'background-position'.  Declaration dropped. 
CSS Error (http://www.h-o-l-d.de/Code/Pages/design_navi.css :41.104): Error in 
parsing value for property 'background-position'.  Declaration dropped. 
CSS Error (http://www.google.de/ :4.2): Selector expected.  Ruleset ignored due 
to bad selector. 
CSS Error (http://www.google.de/ :5.0): Unexpected end of file while searching 
for closing } of invalid rule set. 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
--DOMWINDOW == 11 
--DOMWINDOW == 10 
--DOMWINDOW == 9 
--DOMWINDOW == 8 
--DOMWINDOW == 7 
--DOMWINDOW == 6 
--DOMWINDOW == 5 
--DOMWINDOW == 4 
--DOMWINDOW == 3 
--WEBSHELL == 11 
--WEBSHELL == 10 
--WEBSHELL == 9 
--WEBSHELL == 8 
--WEBSHELL == 7 
--WEBSHELL == 6 
--WEBSHELL == 5 
--WEBSHELL == 4 
--WEBSHELL == 3 
###!!! ASSERTION: View is hidden but widget is visible!: '!visible', file 
nsViewManager.cpp, line 1662 
Break: at file nsViewManager.cpp, line 1662 
WARNING: Tried to get mouse button for null or non-mouse event!, file 
nsDOMEvent.cpp, line 861 
WARNING: NS_ENSURE_TRUE(row != nsnull) failed, file nsFormHistory.cpp, line 316 
CSS Error 
(http://www.google.de/search?q=sol&ie=UTF-8&hl=de&btnG=Google-Suche&meta= :21.31): 
Error in parsing value for property 'cursor'.  Declaration dropped. 
CSS Error 
(http://www.google.de/search?q=sol&ie=UTF-8&hl=de&btnG=Google-Suche&meta= :24.2): 
Selector expected.  Ruleset ignored due to bad selector. 
CSS Error 
(http://www.google.de/search?q=sol&ie=UTF-8&hl=de&btnG=Google-Suche&meta= :25.0): 
Unexpected end of file while searching for closing } of invalid rule set. 
WARNING: NS_ENSURE_TRUE(mDocument) failed, file nsDocumentViewer.cpp, line 1465 
CSS Error (http://www.google.de/ :4.2): Selector expected.  Ruleset ignored due 
to bad selector. 
CSS Error (http://www.google.de/ :5.0): Unexpected end of file while searching 
for closing } of invalid rule set. 
************************************************************ 
* Call to xpconnect wrapped JSObject produced this error:  * 
[Exception... "'Permission denied to get property XULElement.selectedIndex' 
when calling method: [nsIAutoCompletePopup::selectedIndex]"  nsresult: 
"0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)"  location: "JS frame :: 
http://www.google.de/ :: <TOP_LEVEL> :: line 16"  data: no] 
************************************************************ 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
WARNING: Tried to get mouse button for null or non-mouse event!, file 
nsDOMEvent.cpp, line 861 
WARNING: NS_ENSURE_TRUE(row != nsnull) failed, file nsFormHistory.cpp, line 316 
CSS Error 
(http://www.google.de/search?q=so&ie=UTF-8&hl=de&btnG=Google-Suche&meta= :21.31): 
Error in parsing value for property 'cursor'.  Declaration dropped. 
CSS Error 
(http://www.google.de/search?q=so&ie=UTF-8&hl=de&btnG=Google-Suche&meta= :24.2): 
Selector expected.  Ruleset ignored due to bad selector. 
CSS Error 
(http://www.google.de/search?q=so&ie=UTF-8&hl=de&btnG=Google-Suche&meta= :25.0): 
Unexpected end of file while searching for closing } of invalid rule set. 
WARNING: NS_ENSURE_TRUE(mDocument) failed, file nsDocumentViewer.cpp, line 1465 
CSS Error (http://www.google.de/ :4.2): Selector expected.  Ruleset ignored due 
to bad selector. 
CSS Error (http://www.google.de/ :5.0): Unexpected end of file while searching 
for closing } of invalid rule set. 
************************************************************ 
* Call to xpconnect wrapped JSObject produced this error:  * 
[Exception... "'Permission denied to get property XULElement.selectedIndex' 
when calling method: [nsIAutoCompletePopup::selectedIndex]"  nsresult: 
"0x8057001e (NS_ERROR_XPC_JS_THREW_STRING)"  location: "JS frame :: 
http://www.google.de/ :: <TOP_LEVEL> :: line 16"  data: no] 
************************************************************ 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(index past end array) - note on bug 
96108: 'aIndex < Count()', file ../../../../dist/include/xpcom/nsVoidArray.h, 
line 72 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 72 
###!!! ASSERTION: nsVoidArray::ElementAt(negative index) - note on bug 96108: 
'aIndex >= 0', file ../../../../dist/include/xpcom/nsVoidArray.h, line 71 
Break: at file ../../../../dist/include/xpcom/nsVoidArray.h, line 71 
/usr/bin/firefox: line 377:  9174 Segmentation fault      $mozbin "$@" 
 
I hope this help, if u need anything else tell me. 

Comment 18

[Olivier Cahagne]

Philipp, can you attach via "create a new attachment" output of the GDB
stacktrace, instructions follow:
Start Firefox with "firefox -g"
"GDB> run" to start it
Once you crash and go back to console, type:
"GDB> bt" and attach the output here ("bt": backtrace)

Comment 19

[Charles Noneman]

Attachment: Backtrace

This is the result (on Gentoo on amd64) of running firefox -g, going to
www.google.com, and entering the letter "l". This should list about three
options, but instead it crashes.

Comment 20

[Olivier Cahagne]

May be dupe of bug 248442, can you try latest 0.9 build to see if it cures your
crash ?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-0.9/

Comment 21

[Charles Noneman]

None of those are built for 64-bit. Is there anywhere to get the patched source
code?

Comment 22

[Charles Noneman]

It seems to be fixed as of 0.9.3

Comment 23

[Keith Steiger]

Attachment: Fix for this bug

"items" is an array of PRUint32s, and the third argument is supposed to be the
size of the elements in the first argument's array, right?

Comment 24

[Michael Lefevre]

confirming based on multiple reports (not to mention a patch)

Comment 25

[Jesse Ruderman]

Based on the patch, this is a dup of bug 248442.

*** This bug has been marked as a duplicate of 248442 ***

Comment 26

[:Gavin Sharp [email: [e-mail]]]

This has been fixed on aviary. Clearing blocking requests.

Comment 27

[Robert O'Callahan (:roc) (email my personal email if necessary)]

*** Bug 244577 has been marked as a duplicate of this bug. ***