400897 - Loading certain pages with Firebug results in crash [@ js_LookupPropertyWithFlags] [@ js_AllocStack]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Eric Promislow]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8) Gecko/20071008 Firefox/2.0.0.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8) Gecko/20071008 Firefox/2.0.0.8

Redirects to http://www.wired.com/politics/security/news/2007/10/iphone_windows

I got this URL from the wired.com newsfeed.  Whether I click on 
"open in new window" in my feed reader (SharpReader, but it shouldn't
matter), or copy the location and paste it in the address bar, the
same thing happens:

1. Redirect from feeds.wired.com to the above URL
2. The page seems to start to load
3. Within 2 to 15 seconds FF crashes, Talkback extension doesn't show up
(maybe because  I told it to go away earlier, but it's enabled).

FF 2.0.0.8 seems less robust than previous versions

Note that I'm running Windows XP + SP 2 with Windows Firewall disabled
(trusting our IT dept...)

Reproducible: Always

Steps to Reproduce:
1. Open two Firefox windows, with about 9 tabs in one window, 16 in the other.
None of them are running a Google app -- I either do that in Flock on this
PC, or in another machine.
2. Open a new tab in either window
3. Paste in the URL http://www.wired.com/politics/security/news/2007/10/iphone_windows
4. FF will crash.  Every time.
Actual Results:  
Zen nothingness.  When FF restarts if I tell it to restart the
session I have to close the tab containing the iphone story
before FF crashes again.

Expected Results:  
More stability in the browser.

"If you are reporting a crash, note the module in which the software crashed (e.g., Application Violation in gkhtml.dll)."  I'll update this after I submit.  If I try to get that info now I'll lose all the above info, for obvious reasons.

Comment 1

[Eric Promislow]

No module names available -- this was a retail download of FF.
Here's the binary stack dump:
>	js3250.dll!600f0fcf() 	
 	firefox.exe!0042a216() 	
 	firefox.exe!00550e47() 	
 	user32.dll!7e418734() 	
 	user32.dll!7e418bd9() 	
 	user32.dll!7e41885a() 	
 	user32.dll!7e41882a() 	
 	user32.dll!7e41c63f() 	
 	firefox.exe!00550de4() 	
 	user32.dll!7e418734() 	
 	user32.dll!7e418bd9() 	
 	user32.dll!7e41882a() 	
 	firefox.exe!00428b77() 	
 	xpcom_core.dll!6039c8b0() 	
 	user32.dll!7e41f94b() 	
 	user32.dll!7e41f95b() 	
 	user32.dll!7e41b4cb() 	
 	user32.dll!7e41b50c() 	
 	user32.dll!7e41b51c() 	
 	user32.dll!7e41c94b() 	
 	xpcom_core.dll!6039c7b6() 	
 	firefox.exe!0084b221() 	
 	xpcom_core.dll!6038ff04() 	
 	xpcom_core.dll!603902d1() 	
 	firefox.exe!0055cc9b() 	
 	firefox.exe!00851677() 	
 	firefox.exe!004027a2() 	
 	msvcrt.dll!77c3412a() 	
 	msvcrt.dll!77c36cde() 	
 	ntdll.dll!7c91094e() 	
 	firefox.exe!00401012() 	
 	firefox.exe!0040102e() 	
 	firefox.exe!009666e2() 	
 	kernel32.dll!7c816fd7() 	

Comment 2

[Carsten Book [:Tomcat]]

no crash for me with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8) Gecko/2007100816 Firefox/2.0.0.8 and the steps to reproduce.

Do you have a Talkback ID from the Crash ? Do you crash also in Safe Mode (http://kb.mozillazine.org/Safe_mode) ?

Comment 3

[Eric Promislow]

No crash in safe mode.  Yes crash in regular mode.  I ran
it with -console, but no messages appeared.

I haven't seen Talkback come up in the last few hours, so I can't
give you a Talkback ID for the crash.  I just get the generic
"Please tell Microsoft about this problem".

Sample crash message:
Application Error
The instruction at "0x600f0fcf" referenced memory at "0x03aa0000".
The memory could not be "written".

Followed by:
The instruction at "0x5ad776a3" referenced memory at "0x80000035".
The memory could not be "read".

Both those addresses look suspect.

I got a module name: nspr4.dll
Version 4.6.7.0, Offset 00003ab1

Comment 4

[Eric Promislow]

TalkBack just came up.  I filled it in with the URL and a reference
to this bug.  I didn't see an ID though.

Comment 5

[Matthias Versen [:Matti]]

Please read http://kb.mozillazine.org/Talkback how to get the ID from that crash.
The search function of the talkback server doesn't work for me at the moment...

Comment 6

[Matthias Versen [:Matti]]

Found it now, it's 37287293

Comment 7

[Eric Promislow]

The first talkback crash ID was TB37287164E

Comment 8

[Eric Promislow]

FF just crashed when loading
http://www.slideshare.net/acme/whats-new-in-perl-510
from http://conferences.yapceurope.org/npw2007/talk/621

This crash is reproducible.

FF is running in standard mode.

Talkback agent failed to come up.

Do you need a list of the extensions I have loaded and
enabled, or is that available via TB?

Comment 9

[Eric Promislow]

Crashed when loading
http://nntp.perl.org/group/perl.perl5.porters/126358
from http://www.perlmonks.org/?node_id=625552

Repeated crash on restored session.

No TB agent appeared.

Comment 10

[Eric Promislow]

Trying to load http://thetyee.ca/Music/2007/10/25/MusicMyopia/
via "Open in New Window" from SharpReader (RSS reader).

Firefox under normal load (two windows, about 10 tabs/window).

Talkback didn't come up.

Comment 11

[Mats Palmgren (inactive)]

(In reply to comment #8)
> This crash is reproducible.

Does it crash also in Firefox Safe Mode?
Firefox Safe Mode is a debugging startup mode where all added extensions are
disabled and the default theme and toolbar settings are used.
It helps us narrow down the cause of the problem.
http://kb.mozillazine.org/Safe_Mode

Comment 12

[Eric Promislow]

Comment #3 still holds -- for http://thetyee.ca/Music/2007/10/25/MusicMyopia/:
It always crashes in regular mode, does not crash in safe mode.

I saw there are some other bugs against crashes in Firefox
on Windows, (http://developer.mozilla.org/devnews/), in particular
https://bugzilla.mozilla.org/show_bug.cgi?id=400735

At some point I'll download a beta and test it in my environment.
This bug is probably a dup of 400735.

Comment 13

[Mats Palmgren (inactive)]

A build with the fix for bug 400735 is available here:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2007-10-25-03-mozilla1.8/

Comment 14

[Eric Promislow]

BonEcho 2.0.0.9 crashes on the original iPhone URL 

At some point I'll start pulling out extensions to see
if I can narrow it down that way.  Fortunately I don't
have many.

Comment 15

[Eric Promislow]

Looks like a conflict with Firebug 1.05

Disabling Firebug, leaving all other Extensions enabled: 
No crash on the original iPhone URL
(http://feeds.wired.com/~r/wired/topheadlines/~3/173881085/iphone_windows)

Disabling all extensions except Firebug: 
Reproducible crash when loading the URL

Comment 16

[Mats Palmgren (inactive)]

Ok, thanks for narrowing it down to Firebug.  This is probably not a regression
in 2.0.0.8 then, but an older bug.  One of the talkback stacks has
js_LookupPropertyWithFlags() on the top, same as bug 317283 which also
mentions Firebug.  Marking this bug dependent for now.

Comment 17

[Mats Palmgren (inactive)]

Attachment: TB37287164E (for posterity)

Comment 18

[Mats Palmgren (inactive)]

Attachment: TB37287293 (for posterity)

Comment 19

[Eric Promislow]

http://dev.mysql.com/downloads
crashes 2.0.0.9, similar to the other crashes

Enter the URL in the address bar, press return,
and FF either crashes after a delay of 30-60 seconds,
or it starts to present some content and crashes
immediately.

Comment 20

[François Gagné]

Could you confirm the regression range of Bug 317283 comment 19. In clear: for 1.8.1 branch between 2006-09-12 and 2006-09-13.

See http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2006/09/2006-09-12-03-mozilla1.8/http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2006/09/2006-09-12-03-mozilla1.8/firefox-2.0b2.en-US.win32.installer.exe and http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2006/09/2006-09-13-03-mozilla1.8/http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2006/09/2006-09-13-03-mozilla1.8/firefox-2.0b2.en-US.win32.installer.exe

Comment 21

[François Gagné]

arg!

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2006/09/2006-09-12-03-mozilla1.8/firefox-2.0b2.en-US.win32.installer.exe

and

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2006/09/2006-09-13-03-mozilla1.8/firefox-2.0b2.en-US.win32.installer.exe

Comment 22

[Eric Promislow]

François: Yes, I see breakage between these two builds.

All the URLs I listed above load successfully in the 2006-09-12-03 build.

2006-09-13-03 build:

Crashes : http://feeds.wired.com/~r/wired/topheadlines/~3/173881085/iphone_windows 
Crashes : http://www.slideshare.net/acme/whats-new-in-perl-510
Crashes : http://thetyee.ca/Music/2007/10/25/MusicMyopia/
  -- took a long time to crash after loading, but then I'm building Mozilla
in one window and Komodo in another
Crashes : http://dev.mysql.com/downloads

Comment 23

[François Gagné]

Thanks for doing this, this _confirm_ bug 317283 dependency and thus we could hope this bug will be fixed once bug 317283 is fixed.

Comment 24

[Eric Promislow]

You're welcome.  I CC'ed myself to bug 317283 so you can close this one
as a dupe, and I'll track 317283.

Comment 25

[Eric Promislow]

The initial URL crashes Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9, with Firebug enabled.

Comment 26

[Jesse Ruderman on Windows]

Do these pages still crash with up-to-date Firefox and Firebug?

Comment 27

[Rob Campbell [:rc] (:robcee)]

These don't crash for me with Firebug loaded and running. I'm marking this WFM.