278743 - firefox cause an OS fault when visiting the provided URL [@ js_LookupPropertyWithFlags ]

Status: RESOLVED DUPLICATE of bug 276979

(Core :: JavaScript Engine, defect)

Description

[Wenqing Jiang]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: latest firefox nightly builds

Get a recently nightly build of firefox (such as 050115) and visit the
URL above (I did it in win2k) and you'll get a segment fault.  If you
use firefox 1.0 there won't be any problem.

Reproducible: Always

Steps to Reproduce:
1.start a recent firefox nightly build (like 050115)
2.visit the URL provided
3.an OS fault will happen

Comment 1

[Phil Ringnalda (:philor)]

Looks a whole lot like bug 276979 only started by a MouseEvent (synthetic,
apparently, since I didn't click anything or even see anything) instead of a
KeyDown.

Incident ID: 3121623
Stack Signature	js_LookupPropertyWithFlags 337f8882
Product ID	FirefoxTrunk
Build ID	2005011514
Trigger Time	2005-01-17 11:20:37.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0002baf6)
URL visited
https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=5g&F21=IB&F22=5g&lblLanguage=EN&lblTabClicked=Price&lblSeries=A&lblSorted=CATG_ORDER&lblPubAccess=Y&
User Comments	bug 278743
Since Last Crash	147422 sec
Total Uptime	147422 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2484
Stack Trace 	
js_LookupPropertyWithFlags 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2484]
js_LookupProperty 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2411]
js_GetProperty 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2693]
nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 243]
nsXPCWrappedJSClass::DelegatedQueryInterface 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 589]
nsXPCWrappedJS::QueryInterface 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 97]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1604]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2177]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2196]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2196]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2196]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2196]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2196]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5917]
PresShell::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/layout/base/nsPresShell.cpp,
line 5773]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2408]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2133]
HandleEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp, line
174]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1103]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5393]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5644]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1389]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0x89a5 (0x77d489a5)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppStartup::Run 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 147]
main 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Xanthor Sccas]

Crash also on GNU/Linux with Mozilla 1.8a6: TB3153073W
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a6) Gecko/20050111

Comment 3

[Wenqing Jiang]

Just found that the bug is gone for firefox build 20050210 on Windows 2000.

Comment 4

[Hiro]

wfm.
Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; ja-JP; rv:1.8b) Gecko/20050212
Firefox/1.0+

Comment 5

[Xanthor Sccas]

Still crashes with Moz 1.8b1 on GNU/Linux 

Comment 6

[Xanthor Sccas]

Oh, I'm so sorry : I tested with the wrong build :¬(
It WorksForMe too with Moz 1.8b1 on Linux

Comment 7

[Thomas]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050225
Firefox/1.0.1
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050217

Tested with Firefox 1.0.1 & Mozilla Suite 1.8 Beta: no problem with any of those
two. WFM.

Comment 8

[Wenqing Jiang]

I tried ff 1.0.2 and the latest truck builds and could not
reproduce the problem.  I'm marking it as resolved.  Thanks
for all your effort in this.

Comment 9

[Bob Clary [:bc] (inactive)]

without a definite patch, this should be resolved as works for me.

Comment 10

[timeless]

*** This bug has been marked as a duplicate of 276979 ***