303721 - crash immediately upon load of a USPS postage page [@ js_GetGCThingFlags ]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Franklin Bynum]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050806 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050806 Firefox/1.0+

I visited the following link
http://shop.usps.com/cgi-bin/vsbv/postal_store_non_ssl/display_products/productCategory.jsp?prodCat=/Stamps+by+Rate/37-Cent+First+Class
and then clicked for page two (link at top right of page).  (I couldn't copy the
crash URL because it's a JS link from the above page, and FF crashed before I
could copy the URL from the bar.)  Immediately upon loading page 2 FF crashes. 
I did this about ten times, all with the same result.  

Page one (the link above) inconsistently caused a crash in my old FF build
(20050707) but the new build (20050806) has only crashed at page 2.

Reproducible: Always

Steps to Reproduce:
1. Go to 
http://shop.usps.com/cgi-bin/vsbv/postal_store_non_ssl/display_products/productCategory.jsp?prodCat=/Stamps+by+Rate/37-Cent+First+Class
2. Click link for number "2" at top right to visit next page


Actual Results:  
Crash

Expected Results:  
Load page

Comment 1

[Gavin Swanson]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050806
Firefox/1.0+ ID:2005080606


WFM

Comment 2

[Ria Klaassen (not reading all bugmail)]

Yep, I get a crash:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB8154107E

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050806
Firefox/1.0+ ID:2005080622

Comment 3

[zug_treno]

Related to/duplicate of Core bug 302236 -> Core bug 298459?

Comment 4

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b4) Gecko/20050804 SeaMonkey/1.0a

went to page 2, 3, 4, no crash. Clicking Back Button immediate crash.

TB8157612W

js_GetGCThingFlags 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line 231]
js_GC 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line
1702]
js_ForceGC 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line
1510]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 208]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1736]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1760]
KERNEL32.DLL + 0x1b560 (0xbff8b560)
KERNEL32.DLL + 0x1b412 (0xbff8b412)
KERNEL32.DLL + 0x19dd5 (0xbff89dd5)
0xd900d800

Comment 5

[Jaime Mitchell (use [e-mail] for email)]

(In reply to comment #3)
> Related to/duplicate of Core bug 302236 -> Core bug 298459?

I think the stack is slightly different, so maybe not a dupe

Comment 6

[Adam Guthrie]

Is this still reproducible? I have a feeling that bug 298459 might have fixed this.

Comment 7

[Bob Clary [:bc] (inactive)]

wfm in 1.5/trunk on winxp from yesterday.