310481 - crash with short search string and "highlight all" activated [@ xpsp2res.dll + 0x202113] [@ JS_ObjectIsFunction]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Mugros]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050929 Firefox/1.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20050929 Firefox/1.6

The browser crashes if you search for a one char long search string on a
moderatly sized web page

Reproducible: Sometimes

Steps to Reproduce:
1. visit http://www.geizhals.at/deutschland/?cat=dcam
2. activate find toolbar and highlight all
3. enter a char
4. wait for highlighting
Actual Results:  
the browser crashes

Expected Results:  
no crash

TB9867902E
TB9866705Y
TB9866245Q

Comment 1

[Adam Guthrie]

Might need a component change on this...

Incident ID: 9869494
Stack Signature	xpsp2res.dll + 0x202113 (0x20202113) 2f406172
Product ID	FirefoxTrunk
Build ID	2005092807
Trigger Time	2005-09-29 12:01:59.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	xpsp2res.dll + (00202113)
URL visited	
User Comments	
Since Last Crash	65997 sec
Total Uptime	65997 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
xpsp2res.dll + 0x202113 (0x20202113)
JS_ObjectIsFunction 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3285]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1163]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3468]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1183]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3468]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1183]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1260]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 4016]
nsJSContext::CompileFunction 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1375]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6213]
nsGlobalWindow::ClearAllTimeouts 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 6528]
nsAppStartup::nsAppStartup 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 83]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b5) Gecko/20050929
Firefox/1.4 ID:2005092901

WFM

Comment 3

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20051208 Firefox/1.6a1

I get lots of these assertions, but no crash: 

###!!! ASSERTION: forget-word-frame: '(void*)aFrame == mWordFrames->PeekFront()', file /moz/mozilla/layout/generic/nsLineLayout.cpp, line 3033

Comment 4

[chris hofmann]

not able to reproduce using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060313 Firefox/1.5.0.2

Comment 5

[Boris Zbarsky [:bzbarsky]]

There's a good chance the various GC-safety fixes have fixed this...

Comment 6

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060512 Minefield/3.0a1

Marking WFM. Bug 310556 is for the assertion I mentioned in comment 3.