269193 - JavaScript crashes Firefox [@ JS_HashTableRawLookup]

Status: RESOLVED DUPLICATE of bug 253929

(Core :: JavaScript Engine, defect)

Description

[Jan Peter Hecking]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3

Opening the URL http://www.eplus.de/frame.asp?go=/kundenservice/0/0_0/0_0.asp
(referenced from http://www.eplus.de under "Kundenservice") with JavaScript
enabled crashes Mozilla Firefox. Loading the same page with JavaScript disabled
works.

Reproducible: Always
Steps to Reproduce:
1. Enable JavaScript
2. Open http://www.eplus.de/frame.asp?go=/kundenservice/0/0_0/0_0.asp

Actual Results:  
The browser crashes.

Expected Results:  
The EPlus "Kundenservice" web page is displayed.

Talkback incident IDs TB1881011Z, TB1880994X

Comment 1

[Jan Peter Hecking]

User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20041105
Firefox/1.0RC1 (Debian package 0.99+1.0RC1-4)

The same page also crashes Mozilla Firefox 1.0RC1 on Linux. And again only if
JavaScript is enabled.

Comment 2

[Gary van der Merwe]

WFM
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041110
Firefox/0.9.1+

Comment 3

[Jan Peter Hecking]

Hmms, WMF as well on
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20041026
Firefox/1.0RC1

I'll do more testing tomorrow whether any of the Firefox extensions that I'm
using on the other two installations is causing the problem or whether it's some
configuration setting.

Comment 4

[Jan Peter Hecking]

It's a bug in the tabbrowser extensions not Firefox.

I installed a new copy of Firefox 1.0 and started with a new profile. Visiting
the above mentioned web site everything works as expected. Then I installed the
adblock extension. Still the browser does not crash. Next I installed the
tabbrowser extensions from http://piro.sakura.ne.jp/xul/_tabextensions.html.en.
Now, when I visit the same page again the browser consitently crashes.

I'm closing this bug as INVALID and will forward my findings to the author of
the tabbrowser extensions.

Comment 5

[timeless]

Stack Signature	JS_HashTableRawLookup 241c0345
Product ID	Firefox10
Build ID	2004080301
Trigger Time	2004-11-11 09:10:20.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001ac20)
URL visited	
User Comments	
Since Last Crash	47 sec
Total Uptime	4370392 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jshash.c,
line 185
Stack Trace 	
JS_HashTableRawLookup 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jshash.c,
line 185]
js_IndexAtom 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsatom.c,
line 792]
js_EmitTree 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsemit.c,
line 3615]
js_EmitTree 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsemit.c,
line 3520]
Statements 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsparse.c,
line 1026]
js_CompileTokenStream 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsparse.c,
line 451]
CompileTokenStream 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c,
line 3020]
JS_CompileUCScriptForPrincipals 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c,
line 3101]
JS_EvaluateUCScriptForPrincipals 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c,
line 3555]
nsJSContext::EvaluateString 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 946]
nsScriptLoader::EvaluateScript 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/base/src/nsScriptLoader.cpp,
line 660]
nsScriptLoader::ProcessRequest 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/base/src/nsScriptLoader.cpp,
line 573]
nsScriptLoader::ProcessScriptElement 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/base/src/nsScriptLoader.cpp,
line 519]
nsHTMLScriptElement::MaybeProcessScript 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLScriptElement.cpp,
line 656]
nsHTMLScriptElement::SetDocument 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLScriptElement.cpp,
line 469]
HTMLContentSink::ProcessSCRIPTTag 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 4340]
HTMLContentSink::AddLeaf 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/content/html/document/src/nsHTMLContentSink.cpp,
line 3194]
CNavDTD::AddLeaf 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 3787]
CNavDTD::HandleDefaultStartToken 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 1459]
CNavDTD::HandleStartToken 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 1835]
CNavDTD::HandleToken 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 1019]
CNavDTD::BuildModel 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 511]
nsParser::BuildModel 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 1899]

crashes are crashes. on windows we should never crash (this includes when a
plugin dies). actually we should never crash period, but people haven't written
out of process plugins hosting for any platform yet, so that's a few years away.

while a crash induced by a rogue extension isn't a top priority, we may try to
fix it and appreciate the report.

Comment 6

[Brendan Eich [:brendan]]

Can anyone with a debug build reproduce this?  If so, contact me on IRC.

/be

Comment 7

[timeless]

sorry, i generally don't install extensions on principal. and i don't have a
debug build of the implicated product. if someone can confirm that it happens w/
seamonkey, and provides a url, i'll sacrifice a debug build this week. otherwise
calling for reinforcements.

Comment 8

[Justin Wood (:Callek)]

I just loaded TBE in my Suite Nightly debug build...set it to all its default
install settings (for english build, no japanese locale, profile, light version
(quicker))

After that in an entirely new profile, no settings (prefs) changed, I loaded the
url, no crash...is there any set of circumstances to make this happen?  If so I
will be willing to continue testing.

Comment 9

[Bob Clary [:bc] (inactive)]

-> default qa

Comment 10

[timeless]

*** This bug has been marked as a duplicate of 253929 ***