246170 - Frequent crashes on vBulletin board [@ js_LookupProperty() ]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Chris Applegate]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040608 Firefox/0.8.0+
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040608 Firefox/0.8.0+

I experience frequent crashes on this vBulletin board. The crashes occur
immediately after clicking links, and seem to increase in frequency as CPU load
increases, but are otherwise random. I am using Mandrake 10.0 Official with KDE
3.2. I have experienced crashes with the ad banner both visible and blocked. All
other programs continue running as normal.

Reproducible: Sometimes
Steps to Reproduce:
1. Go to http://www.superherohype.com/forums/forumdisplay.php?forumid=212
2. Spend a few minutes reading about horrible movie.

Actual Results:  
Firefox crashes.

Expected Results:  
Not crash.

See TB84158Q, TB84154M, and TB84152Y.

Comment 1

[Chris Applegate]

See also Bug 246185 for similar crash in Thunderbird.

Comment 2

[Philip Mateescu]

I am experiencing the same issue with notebookforums.com. I'm sure it worked in
0.8 and it works in Mozilla 1.6.

Comment 3

[Adam Hauner]

TB84158 (TB84154 and TB84152 look same):
js_LookupProperty() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsobj.c,
line 2369]
LookupArgOrVar() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 1587]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 4139]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 2674]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 3489]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 2950]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 3489]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 2702]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 3489]
js_EmitFunctionBody() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 2455]
js_EmitTree() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsemit.c,
line 2557]
Statements() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsparse.c,
line 1276]
js_CompileTokenStream() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsparse.c,
line 452]
CompileTokenStream() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsapi.c,
line 3020]
JS_CompileUCScriptForPrincipals() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsapi.c,
line 3103]
JS_EvaluateUCScriptForPrincipals() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsapi.c,
line 3553]
nsJSContext::EvaluateString() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 141]
nsScriptLoader::EvaluateScript() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/base/src/nsScriptLoader.cpp,
line 692]
nsScriptLoader::ProcessRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/base/src/nsScriptLoader.cpp,
line 574]
nsScriptLoader::OnStreamComplete() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/content/base/src/nsScriptLoader.cpp,
line 897]
nsStreamLoader::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsStreamLoader.cpp,
line 606]
nsHttpChannel::OnStopRequest() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp,
line 606]
nsInputStreamPump::OnStateStop() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 606]
nsInputStreamPump::OnInputStreamReady() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 339]
nsInputStreamReadyEvent::EventHandler()
PL_HandleEvent() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
PL_ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 608]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp,
line 395]
event_processor_callback() 
[/builds/tinderbox/firefox-1.0/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 67]

-> JS Engine ?

Comment 4

[Chris Applegate]

New CPU, no more crashes --> "bug" was bad hardware.