FF10 crash viewing superbowl ads at ifilm.com [@ Detecting]

VERIFIED FIXED in mozilla1.8beta1

Status

()

Product:
Core
Component:
JavaScript Engine
P1
critical
VERIFIED FIXED
Reported:
14 years ago
Modified:
7 years ago

People

(Reporter: jay, Assigned: brendan)

Tracking

(5 keywords)

Version:
1.0 Branch
Target:
mozilla1.8beta1
Keywords:
crash, fixed-aviary1.0.1, fixed1.7.6, js1.5, topcrash+
Points:
---
Bug Flags:
blocking1.7.6 +
blocking-aviary1.0.1 +
blocking1.8b +
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(1 attachment)

fix
776 bytes, patch
jst
: review+
mkaply
: approval-aviary1.0.1+
mkaply
: approval1.7.6+
mkaply
: approval1.8b+
Details | Diff | Splinter Review
(Reporter)

Description

•
14 years ago 
Probably needs a new component, but I just noticed that this crash has creeped
up on the topcrash list.  A lot of users have been crashing recently at
ifilm.com viewing films.  Here is a recent incident:

Incident ID: 3624289
Stack Signature	Detecting 1e1636d2
Product ID	Firefox10
Build ID	2004110711
Trigger Time	2005-02-10 19:25:38.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (00028a4e)
URL visited	http://dyn.ifilm.com/superbowlads/
User Comments	
Since Last Crash	1008 sec
Total Uptime	313030 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line 2355
Stack Trace 	
Detecting 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2355]
js_LookupProperty 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2587]
js_GetProperty 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c, line
2693]
nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 243]
nsXPCWrappedJSClass::DelegatedQueryInterface 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 589]
nsXPCWrappedJS::QueryInterface 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 97]
nsEventListenerManager::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1524]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleChromeEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 954]
nsDocument::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 3753]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1999]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1993]
nsEventStateManager::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2570]
nsEventStateManager::GenerateMouseEnterExit 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2659]
nsEventStateManager::PreHandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 447]
PresShell::HandleEventInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6056]
PresShell::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5921]
nsViewManager::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2326]
nsViewManager::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2066]
HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0x89a5 (0x77d489a5)
USER32.dll + 0x89e8 (0x77d489e8)
nsAppShell::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppShellService::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

And a link to all "Detecting" crashes, many of which are crashing at the same
url above:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=Detecting&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

Marking this a topcrash+ because of the high visibility.  I have tried
reproducing, but have had zero luck.  I tried viewing a bunch of commercials
with Real Player, WMP, and QuickTime.

Comment 1

•
14 years ago 
brendan: i believe detecting presumes that there's js on the stack, which
doesn't seem to be the case. the fix should be obvious, i'll post one if i reach
the end of my inbox before you reach this bugmail.
Assignee: bugs → brendan
Component: File Handling → File Handling
Product: Firefox → Core
QA Contact: aebrahim-bmo → pschwartau
(Assignee)

Comment 2

•
14 years ago 
Patch next.

/be
Status: NEW → ASSIGNED
Component: File Handling → JavaScript Engine
Flags: blocking1.7.6+
Flags: blocking-aviary1.0.1+
Keywords: js1.5
Priority: -- → P1
Target Milestone: --- → mozilla1.8beta2
(Assignee)

Comment 3

•
14 years ago 
This needs fast approval.

/be
OS: Windows XP → All
Hardware: PC → All
(Assignee)

Comment 4

•
14 years ago 
Created attachment 174353 [details] [diff] [review]
fix

Trivial, obvious fix.

/be
Attachment #174353 - Flags: review?(shaver)
Attachment #174353 - Flags: approval1.7.6?
Attachment #174353 - Flags: approval-aviary1.0.1?
(Assignee)

Comment 5

•
14 years ago 
This should be fixed in 1.8b1.

/be
Flags: blocking1.8b+
Target Milestone: mozilla1.8beta2 → mozilla1.8beta1
 (Assignee)

Updated

•
14 years ago
Attachment #174353 - Flags: approval1.8b?

Comment 6

•
14 years ago 
Comment on attachment 174353 [details] [diff] [review]
fix

r=jst fwiw.
Attachment #174353 - Flags: review?(shaver) → review+

Comment 7

•
14 years ago 
Comment on attachment 174353 [details] [diff] [review]
fix

a=mkaply for everywhere
Attachment #174353 - Flags: approval1.8b?
Attachment #174353 - Flags: approval1.8b+
Attachment #174353 - Flags: approval1.7.6?
Attachment #174353 - Flags: approval1.7.6+
Attachment #174353 - Flags: approval-aviary1.0.1?
Attachment #174353 - Flags: approval-aviary1.0.1+
 (Assignee)

Comment 8

•
14 years ago 
Fixed everywhere.

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 14 years ago
Resolution: --- → FIXED
Keywords: fixed-aviary1.0.1, fixed1.7.6

Comment 9

•
13 years ago 
I cannot crash viewing films at the superbowl ad url using 2005022305-1.0.1 on
winXP sp2. verifying as fixed.
Status: RESOLVED → VERIFIED
 (Reporter)

Comment 10

•
13 years ago 
I was going to wait for some Talkback data after the 1.0.1 release to verify
this.  I have not been able to crash either, so I will double verify once we get
some user data coming in for the new release.
Flags: testcase-
Crash Signature: [@ Detecting]
You need to log in before you can comment on or make changes to this bug.