272387 - Crash on serhend.de [@ntdll.dll + 0x770f (0x77f5770f) 5e8ad53c]

Status: RESOLVED WORKSFORME

(SeaMonkey :: General, defect)

Description

[Karsten Düsterloh]

{Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041129;
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041118}

When Opening the given URL or navigating to serhend.de -> Shop -> Suchen [->
Go], Mozilla crashes. 

Alas, the Talkback trace isn't that helpful:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=2242743
It just reports a crash at ntdll.dll + 0x770f (0x77f5770f) 5e8ad53c.

Debugging a Win32/Cygwinn/MinGW debug build using Eclipse/Cygwin gdb showed this
before dying (htf do you get real data there? :-/) :

Thread [1] (Suspended: Signal 'SIGSEGV' received. Description: Segmentation fault.)
	12 ntdll!RtlTimeToSecondsSince1980() 
	11 ntdll!RtlTimeToSecondsSince1980() 
	10 ntdll!RtlStartRXact() 
	9 <symbol is not available>
	8 <symbol is not available>
	7 <symbol is not available>
	6 <symbol is not available>
	5 <symbol is not available>
	4 ntdll!RtlQueryHeapInformation() 
	3 <symbol is not available>
	2 ntdll!RtlAddAttributeActionToRXact() 
	1 <symbol is not available>

warning: HEAP[mozilla.exe]: 
warning: Heap block at 11D43BA0 modified at 11D478B7 past requested size of 3d0f

warning: HEAP[mozilla.exe]: 
warning: Invalid Address specified to RtlFreeHeap( 003E0000, 11D43BA8 )

warning: HEAP[mozilla.exe]: 
warning: Heap block at 11D478C8 modified at 11D481C8 past requested size of 8f8

warning: HEAP[mozilla.exe]: 
warning: Invalid Address specified to RtlFreeHeap( 003E0000, 11D478D0 )

Comment 1

[Volker Moell]

On Linux Mozilla does not crash, it hangs without CPU load.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a5) Gecko/20041115 Mnenhy/0.6.1.10024

Comment 2

[Volker Moell]

FYI: On Linux the bug (hanging, not crashing) was present at least since
20040930 (this is my oldest Mozilla version I kept).

Comment 3

[Jim Delahanty]

Testing on Microsoft Windows
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a6) Gecko/20041129

This is a Javascript bug, specifically a memory problem when redimensioning
large arrays by adding new members.  It's NOT a coding problem with the website.
 It needs to be addressed.

You can reproduce my findings in the following manner:  

1. Turn OFF Javascript
2. Navigate to http://www.serhend.de/shop/search.htm

Notice that the page loads.

3. Save the page locally (Save As Webpage Complete), in this example, I'm saving
to C:\mozilla_bugs\search.htm

** You can test that the browser will crash with your local copy by navigating
to c:\mozilla_bugs\search.htm with Javascript ON....Go ahead if you want to.**

4. Close Mozilla
5. Open the search.js file in the c:\mozilla_bugs\search_files\ subdirectory
with a useful editor.
6. Edit line #260 to predimension the "Entry" array to 860 entries.
            DID READ: var Entry = new Array();
           NOW READS: var Entry = new Array(860);

7. Save the file.
8. Open Mozilla, Enable Javascript
9. Navigate to C:\mozilla_bugs\search.htm
10. Observe that the file loads correctly.

There are some other Javascript errors in the .js files on that site, but it
needs to be said that implicit array initialization (eg. var Element = new
Array() ) is extremely common in Javascript programming, and this error has to
be trapped effectively.

Comment 4

[Martijn Wargers (dead)]

I think this bug could possibly be similar to bug 244470.

Comment 5

[Karsten Düsterloh]

> I think this bug could possibly be similar to bug 244470.

Maybe. I found that one, too, but I didn't get a meaningful stack here and so
couldn't be sure, so I filed a new bug...

Comment 6

[timeless]

this is heap corruption.

Comment 7

[DigitAl56K]

I have a similar crash (ntdll) on 1.8a6 with http://sinfest.net/ . I assume it's
related.

Comment 8

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b) Gecko/20050122
I was searching for CPU, for Mainboard, for Netzteil.

I also don´t crash on http://sinfest.net/

Comment 9

[Tobias Fischer]

I can't reproduce the crash anymore, neither on serhand.de nor on sinfest.net. Have tested with SeaMonkey 1.1.14 on WinNT 5.0 (and with SeaMonkey 2.0pre).

The serhand Site seems to be changed, the given URI does not work anymore. Navigating on http://www.serhand.de works without crash. 

So I think this should be closed as wfm now, if someone will confirm, that the sites are working now with current Builds/Releases.

Comment 10

[Tobias Fischer]

After asking KaiRo on IRC i close this now as wfm. 

Feel free to reopen, if you are able to reproduce this crash.