299778 - adblock + flashblock + firefox 1.0.4 = firefox crash

Status: VERIFIED WORKSFORME

(Firefox :: General, defect)

Description

[jonathan3d3d]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

When loading http://www.messaging.sprintpcs.com , normally it loads fine.
However, after adblock and flashblock extensions are installed, visiting
http://www.messaging.sprintpcs.com crashes firefox. Completely.

I looked at your "Mozilla Web Developer FAQ" but it doesn't address when firefox
itself crashes. No matter how bad the website code itself is, firefox shouldn't
crash (IMHO). 

My setup:
Windows 2000 Professional with all the updates as of today, july 5th, 2005.
Firefox 1.0.4 (I did an uninstall and reinstall today)
flashblock 1.2.9 extension
adblock 0.5.2.039 extension
thunderbird 1.0.2



Reproducible: Always

Steps to Reproduce:
Steps to reproduce:
1. install firefox 1.0.4
2. install flashblock 1.2.9 (the latest version as of july 5th, 2005)
3. Restart firefox to install flashblock.
4. visit http://www.messaging.sprintpcs.com - the site works fine.
5. install adblock 0.5.2.039 (the latest version as of july 5th, 2005). 
6. Restart firefox to intall adblock. 
7. visit http://www.messaging.sprintpcs.com - the site now crashes.
8. uninstall flashblock. Restart firefox.
9. visit http://www.messaging.sprintpcs.com - the site now works fine again.

I have reproduced this error on two separate win2kpro computers with 100%
regularity.
Actual Results:  
Firefox crashed. See "Steps to reproduce" for more details.

Expected Results:  
It should not crash.

I know that most people probably aren't using flashblock and adblock and
visiting Sprint PCS's SMS gateway. I'm sure there's a way to achieve the
functionality I desire using other extensions like greasemonkey. However, I AM
concerned that this error may have unmasked some kind of buffer overflow or
other potential security issue in the firefox code. Thanks for looking into it.

Comment 1

[jonathan3d3d]

Attachment: Dr. Watson log file of firefox crash

This is my Dr. Watson log file for the crash. I purged the old log file before
re-crashing my setup so there's no extraneous information in the file.

Comment 2

[Przemyslaw Bialik]

Can't reproduce this on latest trunk.
Tested with Adblock_0.5.2.039.xpi + flashblock-1.2.9.xpi and
flashblock-1.3.1.xpi (this is the newest ver, check homepage).

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050705
Firefox/1.0+

Comment 3

[Mortimer]

I have a similar issue.  For me Firefox won't start properly.  It will show up,
but only hotkeys can effect it.  Mouse clicking does no good.  Example:  After
stricking Contorl+T no visual changes will happen.  When closing Firefox I will
be asked if I want to close all open tabs.

This combination of Extensions did work fine for me while using Firefox 0.8

Computer is 1.7 GHz Intel 256ram, running Windows XP Pro

Comment 4

[Robert Strong (they/them - no direct email)]

For this to be looked into a talkback report will need to be submitted. Talkback
can be installed when running the Firefox installer and selecting custom. More
info on talkback is available here:
http://www.mozilla.org/quality/qfa.html

Comment 5

[Nickolay_Ponomarev]

Possibly related to bug 281657. If you can crash Firefox reproducably, please
check if the recent builds from
ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.8/ crash
for you, and if they do, please post the talkback ID. Otherwise, please resolve
this bug as WFM.

Comment 6

[seth wandersman]

I believe I have the same bug. I am getting crashes with firefox 1.06 on Mac os
10.4.2 I have adblock and flashblock.
Here is talkback incident number: TB8827444M

Comment 7

[Nickolay_Ponomarev]

Attachment: talkback details for comment 6

seth: are you sure your problem is the same as this bug, that is, does it go
away after you uninstall one of the two extensions? If so, could you check if
you can still reproduce this problem with a nightly build (be sure to back up
your profile folder before running the nightly).

The top of the stack trace from Seth's talkback report looks like this:
0xfe233c00
nsFrame::Destroy() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/base/src/nsFrame.cpp,
line 647]
nsLineBox::DeleteLineList() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/base/src/nsLineBox.cpp,
line 300]
nsBlockFrame::Destroy() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 304]
nsLineBox::DeleteLineList() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/base/src/nsLineBox.cpp,
line 300]
nsBlockFrame::Destroy() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/base/src/nsBlockFrame.cpp,
line 304]
nsFrameList::DestroyFrames() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/base/src/nsFrameList.cpp,
line 127]
nsCSSFrameConstructor::WipeContainingBlock() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 61]
nsCSSFrameConstructor::ContentInserted() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 8972]
PresShell::ContentInserted() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5238]
nsDocument::ContentInserted() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/content/base/src/nsDocument.cpp,
line 61]
nsGenericElement::InsertChildAt() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2560]
nsGenericElement::doInsertBefore() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/content/base/src/nsGenericElement.cpp,
line 2921]
_XPTC_InvokeByIndex()	XPCWrappedNative::CallMethod(XPCCallContext&,
XPCWrappedNative::CallMode)() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2033]
XPC_WN_CallMethod() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1781]
js_Invoke() 
[/builds/tinderbox/Fx-Aviary1.0.1/Darwin_7.9.0_Depend/mozilla/js/src/jsinterp.c,
line 955]
.....

Comment 8

[Nickolay_Ponomarev]

Hm, the attached dr. Watson log has the following backtrace. Doesn't seem hugely
relevant, but still.

!nsPrintSettings::SetIsCancelled 
!nsRegionRectIterator::Reset 
!nsRegionRectIterator::Reset 
!nsFontList::Release 
!nsFontList::Release 
!nsFontList::Release 
!nsFontList::Release 
!NSCanUnload 
!nsPrintSettings::GetPrintPageDelay 
!NS_RegistryGetFactory 
!js_Invoke 
!js_InternalGetOrSet 
!js_InternalGetOrSet 
!JSLL_MinInt 
!js_Invoke 
!js_InternalGetOrSet 
!js_InternalGetOrSet 
!JS_EvaluateUCScriptForPrincipals 
!nsRegionRectIterator::Reset 
!nsPrintSettings::AddRef 
!nsPrintSettings::AddRef 
!nsScriptableRegion::Release 
!<nosymbols> 
kernel32!ProcessIdToSessionId 

Comment 9

[Benjamin Smedberg]

Bah, wrong bug, sorry for bugspam.

Comment 10

[timeless]

drwatson reports for mozilla.org builds are useless as symbols are stripped for 
talkback (please use talkback...), what you get are exported symbols, e.g. 
JSLL_MinInt 

Comment 11

[jonathan3d3d]

www.messaging.sprintpcs.com has changed their homepage. It no longer crashes
firefox with adblock and flashblock.

Next time I'll grab the site with wget and add it as an attachment. I guess this
one gets marked as WFM (until some other website unleashes this bug, that is).