Closed Bug 299159 Opened 20 years ago Closed 19 years ago

crash when clicking on links in side navigation pane crash [@ UnmarkedGCThingFlags 54c77e65 ]

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED DUPLICATE of bug 298459

People

(Reporter: tonglebeak, Unassigned)

References

(
URL
)

Details

(Keywords: crash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050628 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050628 Firefox/1.0+

Firefox flat out crashes when clicking on links in the sidemenu at the url
given. Crashes for me on "Industry News." Will try to get a talkback id and
testcase.

Reproducible: Always

Steps to Reproduce:
1.Go to url
2.Click on links in side menu ("industry news" did it for me)
3.

Actual Results:  
Crash
talkback id TB7085265H

Attempting to make testcase.
Version: unspecified → Trunk
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050629
Firefox/1.0+ ID:2005062909

Has nothing to do with sidebar , it kills Firefox anyway

TB7085425H
Keywords: talkbackid
hmm it looks like my TB (TB7085395X) is close to Bug 292455
Just to add, if I go to http://bluewirelessdata.com/news.asp directly, it will
not crash. However, if I go to a different site, and I hover over bluewireless'
links durning the load, the next site will load, then ff will crash.
I'm going to nominate for 1.1 here; since I haven't made a testcase yet, but
this should be fixed before an official release.

Will change summary after testcase.
Flags: blocking-aviary1.1?
Stack for TB7085395X

Stack Signature	 UnmarkedGCThingFlags 54c77e65
Product ID	FirefoxTrunk
Build ID	2005062315
Trigger Time	2005-06-29 11:11:38.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0001c5ef)
URL visited	
User Comments	https://bugzilla.mozilla.org/show_bug.cgi?id=299159 the URL at the
bug crashes firefox
Since Last Crash	235823 sec
Total Uptime	235823 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1038
Stack Trace 	
UnmarkedGCThingFlags 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1038]
js_GC  [c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c,
line 1694]
js_ForceGC 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsgc.c, line 1502]
nsAutoCompleteController::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/autocomplete/src/nsAutoCompleteController.cpp,
line 56]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)
Component: General → JavaScript Engine
Keywords: talkbackid
Product: Firefox → Core
Summary: crash when clicking on links in sidebar → crash when clicking on links in side navigation pane
Keywords: crash
Summary: crash when clicking on links in side navigation pane → crash when clicking on links in side navigation pane crash [ @ UnmarkedGCThingFlags 54c77e65 ]
Grr...well, I've been unable to make a testcase, but Jaime's stacktrace should
point to the problem...nominating 1.8b3? to see if devs want to ship DPa2 with
this bug or not.
Flags: blocking1.8b3?
Flags: blocking1.8b3?
Flags: blocking1.8b3-
Flags: blocking-aviary1.1?
Flags: blocking-aviary1.1-
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b3) Gecko/20050712
Firefox/1.0+ ID:2005071206

I had a crash on another site (not exactly sure which one) and the stack
(TB7416230W) matches this one - comment 6

-> New
Assignee: nobody → general
Status: UNCONFIRMED → NEW
Ever confirmed: true
QA Contact: general → general
This may be a dup of bug 298459 -- are reporters enabling the fast back/forward
cache via browser.sessionhistory.max_viewers pref?

/be
Depends on: 298459
(In reply to comment #9)
> This may be a dup of bug 298459 -- are reporters enabling the fast back/forward
> cache via browser.sessionhistory.max_viewers pref?

Yes I have fast back enabled (pref set to 10)


(In reply to comment #9)
> This may be a dup of bug 298459 -- are reporters enabling the fast back/forward
> cache via browser.sessionhistory.max_viewers pref?
> 
> /be

Not so sure it'd be a dupe...but anyways, disabling bfcache makes this WFM.
Running a debug build of 7/28, here's the fun fun fun (note I did not use windbg
as it was sucking at starting firefox)

Unless I'm stupid, there should be enough info to help for a fix. Nominating 1.84b4?

###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
WARNING: Failed to copy non-string-named window property, file c:/mozilla/dom/sr
c/base/nsGlobalWindow.cpp, line 5982
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file c:/mozilla/docshell/base/
nsDocShell.cpp, line 4869
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
WARNING: Failed to copy non-string-named window property, file c:/mozilla/dom/sr
c/base/nsGlobalWindow.cpp, line 5982
WARNING: NS_ENSURE_TRUE(NS_SUCCEEDED(rv)) failed, file c:/mozilla/docshell/base/
nsDocShell.cpp, line 4869
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
###!!! ASSERTION: index of child element is out of range!: 'aIndex >=0 && aIndex
 < mChildList.Count()', file c:/mozilla/docshell/base/nsDocShell.cpp, line 2437
WARNING: NS_ENSURE_TRUE(child) failed, file c:/mozilla/docshell/base/nsDocShell.
cpp, line 2440
JS API usage error: the address passed to JS_AddNamedRoot currently holds an
invalid jsval.  This is usually caused by a missing call to JS_RemoveRoot.
The root's name is "WindowStateHolder::mJSObj".
Assertion failure: root_points_to_gcArenaPool, at c:/mozilla/js/src/jsgc.c:1474
Flags: blocking1.8b4?
Flags: blocking1.8b4? → blocking1.8b4-
Marking DUP -- we don't have a better theory, the facts don't justify two such
similar or identical bugs.

/be

*** This bug has been marked as a duplicate of 298459 ***
Status: NEW → RESOLVED
Closed: 19 years ago
No longer depends on: 298459
Resolution: --- → DUPLICATE
Status: RESOLVED → VERIFIED
Summary: crash when clicking on links in side navigation pane crash [ @ UnmarkedGCThingFlags 54c77e65 ] → crash when clicking on links in side navigation pane crash [@ UnmarkedGCThingFlags 54c77e65 ]
Crash Signature: [@ UnmarkedGCThingFlags 54c77e65 ]
You need to log in before you can comment on or make changes to this bug.