63136 - http://www.sinterklaas.nl/ crashes mozilla

Status: VERIFIED DUPLICATE of bug 60460

(SeaMonkey :: General, defect)

Description

[Frank de Lange]

Mozilla does not survive a visit to the page mentioned in the URL
(http://www.sinterklaas.nl/).

Comment 1

[Boris Zbarsky [:bzbarsky]]

Reporter, what build are you using?  I see no crash with linux nightly
2000-12-05-08 and linux cvs build from 2000-12-15

Comment 2

[Frank de Lange]

Using optimized (--enable-optimize --disable-debug --enable-strip-libs) Linux   
CVS build 2000-12-17 (last checkout app. 20:00 GMT) on Linux 2.4.0-test12 with
glibc-2.2 (no, not Redhat 7.0... Just keeping up to date on my own), gcc 2.95.2

Comment 3

[HJ]

Seems to be no problem for build 2000121117 on WinNT Sp6b

Comment 4

[Asa Dotzler [:asa]]

worksforme with 121808 mozilla build on redhat6.2

Comment 5

[Doron Rosenberg (IBM)]

seeing this crash on cvs build from early today (19 december)

Comment 6

[Keyser Sose]

Worksforme
Platform: PC
OS: Linux 2.2.16 RedHat 6.2
Mozilla Build: 2000121908 M18 Trunk Build

Comment 7

[Doron Rosenberg (IBM)]

marking worksforme, linux on a cvs build from 5 minutes ago.  Seems to be fixed.
reporter, can you verify?

Comment 8

[Frank de Lange]

Attachment: HTML code which crashes mozilla

Comment 9

[Frank de Lange]

Hm, I just put down a whole story, and attached a file, but bugzilla forgot the
story...

The thing is, I found out which part of the page makes Mozilla crash. I attached
the guilty code to this bug. The crash happens right after Moz tries to download
an image from Nedstat (http://www.nedstat.nl/cgi-bin/nedstat.gif?name=stoompage)
which does not seem to succeed (if I try it manually, it eventually times out.
If I try the same URL with wget, it happily downloads the well-known nedstat
logo... go figure). Anyway, once the download times out, could it be that
Mozilla tries to run some of that Javascript code on the page and reference
something which does not exist? Just guessing, but I get a reliable crash each
time I load the code...

Comment 10

[Frank de Lange]

Just tested it by trying to open the attached file from this page in mozilla: it
crashed...

Comment 11

[Asa Dotzler [:asa]]

can anyone get a stack trace?

Comment 12

[Frank de Lange]

Working on that stack trace, now compiling a debug build from a fresh CVS
pull... hold on...

Comment 13

[Frank de Lange]

Here's the output from a debug build. It dies with an assertion at the end:

JavaScript strict warning: 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=21085 line 16:
assignment to undeclared variable an

JavaScript strict warning: 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=21085 line 16:
assignment to undeclared variable d

JavaScript strict warning: 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=21085 line 20:
assignment to undeclared variable srb

JavaScript strict warning: 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=21085 line 20:
assignment to undeclared variable srw

JavaScript strict warning: 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=21085 line 28:
assignment to undeclared variable s

JavaScript strict warning: 
http://bugzilla.mozilla.org/showattachment.cgi?attach_id=21085 line 37:
assignment to undeclared variable r

Assertion failure: ic->clients == NULL, at
../../../../../mozilla/modules/libimg/src/ilclient.cpp:647

And here's the stack trace:

Script started on Thu Dec 21 19:28:48 2000
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...

/var/home/stage/arianne/738: No such file or directory.
Attaching to program:
/home/stage/mozilla-cvs/BUILD/mozilla/dist/bin/mozilla-bin, Pid 738

****removed symbol loading information, available on request, not interesting

(gdb) c
Continuing.

Program received signal SIG32, Real-time event 32.
0x40327085 in sigsuspend () at ../sysdeps/unix/sysv/linux/sigsuspend.c:66
66	../sysdeps/unix/sysv/linux/sigsuspend.c: No such file or directory.
Current language:  auto; currently c
(gdb) c
Continuing.

Program received signal SIG32, Real-time event 32.
0x40327085 in sigsuspend () at ../sysdeps/unix/sysv/linux/sigsuspend.c:66
66	in ../sysdeps/unix/sysv/linux/sigsuspend.c
(gdb) c
Continuing.

Program received signal SIG32, Real-time event 32.
0x40327085 in sigsuspend () at ../sysdeps/unix/sysv/linux/sigsuspend.c:66
66	in ../sysdeps/unix/sysv/linux/sigsuspend.c
(gdb) c
Continuing.

Program received signal SIGABRT, Aborted.
0x40326fe1 in __kill () from /lib/libc.so.6
(gdb) info threads
(gdb) bt
#0  0x40326fe1 in __kill () from /lib/libc.so.6
#1  0x4028302d in raise () from /lib/libpthread.so.0
#2  0x4032842b in abort () at ../sysdeps/generic/abort.c:139
#3  0x40239ea9 in PR_Assert (s=0x4005510e "ic->clients == NULL", 
    file=0x40054f20 "../../../../../mozilla/modules/libimg/src/ilclient.cpp", 
    ln=647) at prlog.c:477
#4  0x40040a59 in il_delete_container (ic=0x42e88350)
    at ../../../../../mozilla/modules/libimg/src/ilclient.cpp:647
#5  0x4003d830 in IL_NetRequestDone (ic=0x42e88350, url=0x42e97ff8, status=0)
    at ../../../../../mozilla/modules/libimg/src/if.cpp:1179
#6  0x4003a2e4 in NetReaderImpl::NetRequestDone (this=0x42e7c330, 
    urls=0x42e97ff8, status=0)
    at ../../../../../mozilla/modules/libimg/src/ilNetReader.cpp:139
#7  0x4002ee4c in ImageConsumer::OnStopRequest (this=0x42e7c2b8, 
    channel=0x42e884f0, aContext=0x0, status=0, aMsg=0x401564a8)
    at ../../../../mozilla/gfx/src/nsImageNetContextAsync.cpp:551
#8  0x411c7c8d in nsDocumentOpenInfo::OnStopRequest (this=0x42ecb908, 
    aChannel=0x42e884f0, aCtxt=0x0, aStatus=0, errorMsg=0x401564a8)
    at ../../../../mozilla/uriloader/base/nsURILoader.cpp:274
#9  0x40d0106e in nsHTTPFinalListener::OnStopRequest (this=0x42e870a0, 
    aChannel=0x42e884f0, aContext=0x0, aStatus=0, aStatusArg=0x401564a8)
    at
../../../../../../mozilla/netwerk/protocol/http/src/nsHTTPResponseListener.cpp:1167
---Type <return> to continue, or q <return> to quit---
#10 0x40cc22c1 in InterceptStreamListener::OnStopRequest (this=0x42e98ca8, 
    channel=0x42e884f0, ctxt=0x0, aStatus=0, aStatusArg=0x401564a8)
    at ../../../../../mozilla/netwerk/cache/mgr/nsCachedNetData.cpp:1211
#11 0x40cf1f58 in nsHTTPChannel::ResponseCompleted (this=0x42e884f0, 
    aListener=0x42e98ca8, aStatus=0, aStatusArg=0x401564a8)
    at
../../../../../../mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp:1923
#12 0x40cfff54 in nsHTTPServerListener::OnStopRequest (this=0x42e784f8, 
    channel=0x42e2dd0c, i_pContext=0x42e884f0, i_Status=0, 
    aStatusArg=0x401564a8)
    at
../../../../../../mozilla/netwerk/protocol/http/src/nsHTTPResponseListener.cpp:729
#13 0x40c7cc01 in nsOnStopRequestEvent::HandleEvent (this=0x81ae4f0)
    at ../../../../../mozilla/netwerk/base/src/nsAsyncStreamListener.cpp:300
#14 0x40c7bfa3 in nsStreamListenerEvent::HandlePLEvent (aEvent=0x81ae4fc)
    at ../../../../../mozilla/netwerk/base/src/nsAsyncStreamListener.cpp:92
#15 0x40101093 in PL_HandleEvent (self=0x81ae4fc)
    at ../../../../mozilla/xpcom/threads/plevent.c:576
#16 0x40100ee9 in PL_ProcessPendingEvents (self=0x80a9710)
    at ../../../../mozilla/xpcom/threads/plevent.c:509
#17 0x40102eac in nsEventQueueImpl::ProcessPendingEvents (this=0x80a96e8)
    at ../../../../mozilla/xpcom/threads/nsEventQueue.cpp:356
#18 0x40707e5d in event_processor_callback (data=0x80a96e8, source=5, 
---Type <return> to continue, or q <return> to quit---
    condition=GDK_INPUT_READ)
    at ../../../../../mozilla/widget/src/gtk/nsAppShell.cpp:158
#19 0x40707ab8 in our_gdk_io_invoke (source=0x410b47d8, condition=G_IO_IN, 
    data=0x42149920) at ../../../../../mozilla/widget/src/gtk/nsAppShell.cpp:58
#20 0x408ee971 in g_io_unix_dispatch () from /usr/lib/libglib-1.2.so.0
#21 0x408efcf9 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0
#22 0x408f0343 in g_main_iterate () from /usr/lib/libglib-1.2.so.0
#23 0x408f0c7c in g_main_run () from /usr/lib/libglib-1.2.so.0
#24 0x40803949 in gtk_main () from /usr/lib/libgtk-1.2.so.0
#25 0x40708baa in nsAppShell::Run (this=0x80aca48)
    at ../../../../../mozilla/widget/src/gtk/nsAppShell.cpp:350
#26 0x40627907 in nsAppShellService::Run (this=0x80680f0)
    at ../../../../../mozilla/xpfe/appshell/src/nsAppShellService.cpp:407
#27 0x8052ebb in main1 (argc=1, argv=0xbffff2ac, nativeApp=0x0)
    at ../../../../mozilla/xpfe/bootstrap/nsAppRunner.cpp:1019
#28 0x8053c5b in main (argc=1, argv=0xbffff2ac)
    at ../../../../mozilla/xpfe/bootstrap/nsAppRunner.cpp:1287
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) y
Detaching from program:
/home/stage/mozilla-cvs/BUILD/mozilla/dist/bin/mozilla-bin, Pid 738
[frank@behemoth arianne]$ uname -a
Linux behemoth.localnet 2.4.0-test12 #1 SMP Wed Dec 13 17:04:54 CET 2000 i686
unknown
[frank@behemoth arianne]$ /lib/libc.so.6 
GNU C Library stable release version 2.2, by Roland McGrath et al.
Copyright (C) 1992,93,94,95,96,97,98,99,2000 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 2.95.2 19991024 (release).
Compiled on a Linux 2.4.0-test11 system on 2000-11-23.
Available extensions:
	GNU libio by Per Bothner
	crypt add-on version 2.1 by Michael Glad and others
	The C stubs add-on version 2.1.2.
	BIND-8.2.3-T5B
	NIS(YP)/NIS+ NSS modules 0.19 by Thorsten Kukuk
	Glibc-2.0 compatibility add-on by Cristian Gafton 
	linuxthreads-0.9 by Xavier Leroy
	libthread_db work sponsored by Alpha Processor Inc
Report bugs using the `glibcbug' script to <[e-mail]>.
[frank@behemoth arianne]$ exit

Script done on Thu Dec 21 19:32:29 2000

Comment 14

[timeless]

dupe

*** This bug has been marked as a duplicate of 60460 ***

Comment 15

[Diego]

It's a dupe (same stack) of bug 61756: "crash stack: il_delete_container"
This bug has a fix

(bug 60460 is a dupe of 61756)