361338 - reproducible crash on de.search.yahoo.com [ypstate]

Status: RESOLVED INCOMPLETE

(Core :: General, defect)

Description

[Jon Granrose]

I have a reproducible USER32.dll crash for FF1.5 and FF2.0.  I don't have a trunk build handy so I haven't tried to reproduce it there.

Steps to reproduce:
- go to http://de.yahoo.com
- go to http://de.search.yahoo.com
- go to http://de.yahoo.com
- crash

This is in a new profile, no 3rd party extensions installed.  I'm not sure if anything can be done, but since it's easily reproducible, wanted to file a bug.

Talkback incident report:

http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB26281174Y

ccing Jay since this isn't a topcrash and I'm not sure what the current keywords, etc. are to get some talkback love.

Thanks.

Comment 1

[Brian Polidoro]

Confirmed on trunk:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061120 Minefield/3.0a1 ID:2006112004 [cairo]

My stack looks slightly different.  But that may be because the Yahoo State Plugin is involved for mine.

Incident ID: 26286828
Stack Signature	0x04d42700 f256835e
Product ID	FirefoxTrunk
Build ID	2006112004
Trigger Time	2006-11-20 20:15:12.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	
URL visited	
User Comments	
Since Last Crash	24 sec
Total Uptime	24 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
0x04d42700
USER32.dll + 0x8734 (0x77d48734)
USER32.dll + 0xd05b (0x77d4d05b)
USER32.dll + 0xb4c0 (0x77d4b4c0)
USER32.dll + 0xfd29 (0x77d4fd29)
ntdll.dll + 0xeae3 (0x7c90eae3)
USER32.dll + 0x101f7 (0x77d501f7)
USER32.dll + 0xff83 (0x77d4ff83)
npYState.dll + 0x208a (0x04ea208a)
0x04df2044
npYState.dll + 0x1380 (0x04ea1380)
0xfffffdf8

Comment 2

[Brian Polidoro]

Looking at the first URL with a debug build I get a breakpoint triggered because of heap corruption.  

I get a bunch of these repeating in the stack:
 	01fd9318()	
 	nspr4.dll!_PR_MD_UNLOCK(_MDLock * lock=0x0012eb58)  Line 347	C
	nspr4.dll!PR_Unlock(PRLock * lock=0x7ffd7000)  Line 355 + 0xc bytes	C
 	01fd9318()	

Comment 3

[Brian Polidoro]

As my talkback suggested it looks like a Yahoo State Plugin problem for me.  I renamed npYState.dll and then no crash occurs.  

I have Yahoo Messenger 8.1.0.195.

Comment 4

[Jesse Ruderman on Windows]

This might have been bug 419127.