281984 - FF10 crash viewing superbowl ads at ifilm.com [@ Detecting]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jay Patel [:jay]]

Probably needs a new component, but I just noticed that this crash has creeped
up on the topcrash list.  A lot of users have been crashing recently at
ifilm.com viewing films.  Here is a recent incident:

Incident ID: 3624289
Stack Signature	Detecting 1e1636d2
Product ID	Firefox10
Build ID	2004110711
Trigger Time	2005-02-10 19:25:38.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (00028a4e)
URL visited	http://dyn.ifilm.com/superbowlads/
User Comments	
Since Last Crash	1008 sec
Total Uptime	313030 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2355
Stack Trace 	
Detecting 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2355]
js_LookupProperty 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2587]
js_GetProperty 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2693]
nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 243]
nsXPCWrappedJSClass::DelegatedQueryInterface 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 589]
nsXPCWrappedJS::QueryInterface 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 97]
nsEventListenerManager::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1524]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleChromeEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 954]
nsDocument::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 3753]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1999]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsEventStateManager::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2570]
nsEventStateManager::GenerateMouseEnterExit 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2659]
nsEventStateManager::PreHandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 447]
PresShell::HandleEventInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6056]
PresShell::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5921]
nsViewManager::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2326]
nsViewManager::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2066]
HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0x89a5 (0x77d489a5)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppShellService::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

And a link to all "Detecting" crashes, many of which are crashing at the same
url above:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=Detecting&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Marking this a topcrash+ because of the high visibility.  I have tried
reproducing, but have had zero luck.  I tried viewing a bunch of commercials
with Real Player, WMP, and QuickTime.

Comment 1

[timeless]

brendan: i believe detecting presumes that there's js on the stack, which
doesn't seem to be the case. the fix should be obvious, i'll post one if i reach
the end of my inbox before you reach this bugmail.

Comment 2

[Brendan Eich [:brendan]]

Patch next.

/be

Comment 3

[Brendan Eich [:brendan]]

This needs fast approval.

/be

Comment 4

[Brendan Eich [:brendan]]

Attachment: fix

Trivial, obvious fix.

/be

Comment 5

[Brendan Eich [:brendan]]

This should be fixed in 1.8b1.

/be

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 174353 [details] [diff] [review]
fix

r=jst fwiw.

Comment 7

[Mike Kaply [:mkaply]]

Comment on attachment 174353 [details] [diff] [review]
fix

a=mkaply for everywhere

Comment 8

[Brendan Eich [:brendan]]

Fixed everywhere.

/be

Comment 9

[sairuh (rarely reading bugmail)]

I cannot crash viewing films at the superbowl ad url using 2005022305-1.0.1 on
winXP sp2. verifying as fixed.

Comment 10

[Jay Patel [:jay]]

I was going to wait for some Talkback data after the 1.0.1 release to verify
this.  I have not been able to crash either, so I will double verify once we get
some user data coming in for the new release.