416932 - propagandamatrix, infowars, prisonplanet, etc. crash Firefox 3

Status: VERIFIED DUPLICATE of bug 303821

(Core :: XPConnect, defect)

Description

[Jeff Cook]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b2) Gecko/2007121016 Firefox/3.0b2
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9b2) Gecko/2007121016 Firefox/3.0b2

I've not included the URLs of these broken sites via the Reporter mechanism as instructed above as it wouldn't let me change the URL. http://www.propagandamatrix.com/articles/february2008/021108_changed_gop.htm , which was on the front page of reddit.com today, causes Firefox 3 to crash when it finishes loading. I followed a link to http://www.prisonplanet.tv a bit later and Fx3 crashed there too. This effects CVS as of earlier today, too. It's probably triggered by a common piece of JavaScript; these sites all share common operators. firefox -g dump coming up.

Reproducible: Always

Steps to Reproduce:
1. Visit website
2. Enjoy crash
Actual Results:  
Firefox crashes without providing any reporting facility.

Expected Results:  
Displayed the page appropriately.

Comment 1

[Jeff Cook]

Attachment: firefox -g output, bt really short so thought I'd include the whole thing : )

firefox -g, opened browser, went to http://www.propagandamatrix.com/articles/february2008/021108_changed_gop.htm , this happened.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Same crash happens for me with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b4pre) Gecko/2008021104 Minefield/3.0b4pre ID:2008021104

Crash-Reporter id: bp-df131733-d97d-11dc-b2f9-001a4bd43ed6

0  	arena_malloc_small  	 jemalloc.c:3584
1 	arena_malloc 	jemalloc.c:3691
2 	malloc 	jemalloc.c:5637
3 	operator new(unsigned int) 	new.cpp:54
4 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:135
5 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
6 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
7 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
8 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
9 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
10 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
11 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
12 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
13 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
14 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
15 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
16 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
17 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
18 	XPCJSStackFrame::CreateStack(JSContext*, JSStackFrame*, XPCJSStackFrame**) 	mozilla/js/src/xpconnect/src/xpcstack.cpp:144
[...]
23174  	nsXPConnect::GetCurrentJSStack(nsIStackFrame**)  	 mozilla/js/src/xpconnect/src/nsXPConnect.cpp:1624
23175 	nsXPCComponents::GetStack(nsIStackFrame**) 	mozilla/js/src/xpconnect/src/xpccomponents.cpp:3874
23176 	NS_InvokeByIndex_P 	mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:101
23177 	xptiInterfaceInfo::GetMethodInfo(unsigned short, nsXPTMethodInfo const**) 	mozilla/xpcom/reflect/xptinfo/src/xptiprivate.h:706

In between there are over 23000 calls to GetCurrentJSStack.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Mmh looks like bug 303821?

Comment 4

[timeless]

sure does

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified dup