273221 - Crash when opening a pop-up compose window that was blocked despite being on whitelist [@ js_MarkScript]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[David]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

When I attempt to open a pop-up compose window in gmail (by holding shift when
clicking the link) it is blocked, the first time this happened I added gmail to
the whitelist, tried to open it again, it again failed to open, so I clicked on
the banner-thingy and tried to open it from there, it started to open and then
firefox crashed.  When I re-opened the browser, I tried again and despite now
being on the whitelist for certain, the pop-up was still blocked, and opening it
from the banner caused the same crash.

Reproducible: Always
Steps to Reproduce:
(see above)
Actual Results:  
Both talkback and windows error reporting appeared.

Expected Results:  
a) opened the pop-up without being forced 
b) not crashed 

Talkback crash IDs: TB2365794K and TB2365829X (it's a bit hard to find that app,
didn't it used to have its own icon in the start menu?) 

Extensions: Tabbrowser Extensions 1.11.2004120101 and Flashblock 1.0RC2 

Images were turned off (I was reading other web-mail at the time too) 

Gmail was using https

Comment 1

[timeless]

Stack Signature	 js_MarkScript f8e43748
Product ID	Firefox10
Build ID	2004110711
Trigger Time	2004-12-05 01:09:41.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0003bafa)
URL visited	https://gmail.google.com
User Comments	
Since Last Crash	51451 sec
Total Uptime	51451 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsscript.c,
line 1178
Stack Trace 	
js_MarkScript 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsscript.c,
line 1178]
fun_mark 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsfun.c, line
1343]
js_Mark 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
3918]
js_MarkGCThing 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 865]
js_MarkGCThing 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 919]
js_MarkGCThing 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 919]
gc_root_marker 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 975]
js_GC  [d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c,
line 1189]
js_ForceGC 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 1000]
nsAppShellService::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Brendan Eich [:brendan]]

Timeless: any reason in particular for moving this bug to JavaScript Engine?  It
would help to know the name of the root being marked.  This kind of crash can be
caused by JS API abuse, and there's no known engine bug with such a signature. 
Did you reproduce this yourself using gmail?

I think it would be better to CONFIRM this bug than just shuffle component.

/be

Comment 3

[timeless]

looking for someone to look into it. so far i haven't had this crash, and i use
gmail a lot. if i do manage to hit it a lot it'll immediately jump to the top of
my list (just below critical things like performance evals).

Comment 4

[Jay Patel [:jay]]

I have not seen this crash either...and I use Gmail often.  

David:  What exactly do you mean by "so I clicked on the banner-thingy"?  And
have you tried reproducing this crash with a fresh profile without the
TabBrowser Extension installed? TBE has been causing a lot of weird behavior and
crashes for some users.  Give that a shot with a recent nightly and report back.
 Thanks.

Comment 5

[Bob Clary [:bc] (inactive)]

per comments, marking works for me. David if you can reproduce with a recent
build and a fresh profile with no extensions like Jay asked in comment 4, please
reopen.