639300 - Whenever i use a javascript heavy online mail like aol or new yahoo mail seamonkey crashes [@ strcmp | nsAccUtils::GetRoleMapEntry ]

Status: RESOLVED INCOMPLETE

(Core :: Disability Access APIs, defect)

Description

[vazhavandan]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.17) Gecko/20110121 SUSE/2.0.12-1.1 SeaMonkey/2.0.12
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.17) Gecko/20110121 SUSE/2.0.12-1.1 SeaMonkey/2.0.12

Logs created by bug buddy uploaded to below urls:-

http://uploading.com/files/7dcdeb71/seamonkey-bin-bugreport-yahoo.txt/
http://uploading.com/files/7m46c32f/seamonkey-bin-bugreport-aol.txt/


Reproducible: Always

Steps to Reproduce:
1.Login into yahoo mail
2.yahoo page asking to use old version
3.i choose new version,crashes as soon as page loads

1.Login into aol mail
2.click on inbox icon on left and it crashes
Actual Results:  
Doesn't crash when lighter versions of online mails are used

Expected Results:  
Should not crash

1.Login into yahoo mail
2.yahoo page asking to use old version
3.i choose new version,crashes as soon as page loads

1.Login into aol mail
2.click on inbox icon on left and it crashes

Doesn't crash when lighter versions of online mails are used

Comment 1

[Matthias Versen [:Matti]]

We can't use bug buddy files.
We need a stack trace with debug symbols. The easy why is to use a Mozilla.org binary build and use the building crash reporter.use the alternative way if you don't want to do that.
https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Comment 2

[vazhavandan]

i used the binary from here:-
http://download.mozilla.org/?product=seamonkey-2.0.12&os=linux&lang=en-US
irony is crash reporter failed to send bug
i have zipped the crash folder and uploaded here :-

http://uploading.com/files/782m591m/Crash%2BReports.zip/

Also bt output from seamonkey -d gdb is :-

Program received signal SIGSEGV, Segmentation fault.
0xb6c23eea in strcmp () from /lib/libc.so.6
(gdb) bt
#0  0xb6c23eea in strcmp () from /lib/libc.so.6
#1  0xb7dd395b in PL_strcmp () from /usr/lib/libplc4.so
#2  0x087756c7 in ?? ()
#3  0x08736684 in ?? ()
#4  0x0873efd3 in ?? ()
#5  0x0873f024 in ?? ()
#6  0x0873f030 in ?? ()
#7  0x0873f112 in ?? ()
#8  0x087373a3 in ?? ()
#9  0x0874df7d in ?? ()
#10 0x08737099 in ?? ()
#11 0x08738d05 in ?? ()
#12 0x087398e4 in ?? ()
#13 0x0874ef85 in ?? ()
#14 0x08771f83 in ?? ()
#15 0x087729ed in ?? ()
#16 0xb7e3eb8b in ?? () from /usr/lib/seamonkey/libxpcom_core.so
#17 0xb7e3ed35 in ?? () from /usr/lib/seamonkey/libxpcom_core.so
#18 0xb7e3bc5d in ?? () from /usr/lib/seamonkey/libxpcom_core.so
#19 0xb7e08a5f in NS_ProcessNextEvent_P(nsIThread*, int) () from /usr/lib/seamonkey/libxpcom_core.so
#20 0x08248e91 in ?? ()
#21 0x087cf079 in ?? ()
#22 0x08080618 in ?? ()
#23 0x0807bf18 in ?? ()
#24 0xb6bc4c0e in __libc_start_main () from /lib/libc.so.6
#25 0x0807bd91 in ?? ()
(gdb) quit
A debugging session is active.

	Inferior 1 [process 3951] will be killed.

Quit anyway? (y or n) y

Comment 3

[Matthias Versen [:Matti]]

>i have zipped the crash folder and uploaded here
That doesn't help :-(
The crash dump is only the half part part of the needed information and the other part is on the crash server. There is no way to upload the files to the crash server.

Comment 4

[vazhavandan]

I could finally submit one :-)

Crash ID: bp-e61ed929-ab7d-4e9a-a894-06c5c2110306

Comment 5

[Matthias Versen [:Matti]]

0 	libc-2.11.2.so 	libc-2.11.2.so@0x75eea 	
1 	seamonkey-bin 	nsAccUtils::GetRoleMapEntry 	accessible/src/base/nsAccUtils.cpp:656
2 	seamonkey-bin 	nsAccessibilityService::GetAccessible 	accessible/src/base/nsAccessibilityService.cpp:1503
3 	seamonkey-bin 	nsAccessibleTreeWalker::GetAccessible 	accessible/src/base/nsAccessibleTreeWalker.cpp:292
4 	seamonkey-bin 	nsAccessibleTreeWalker::GetFirstChild 	accessible/src/base/nsAccessibleTreeWalker.cpp:221
5 	seamonkey-bin 	nsAccessibleTreeWalker::GetFirstChild 	accessible/src/base/nsAccessibleTreeWalker.cpp:221
6 	seamonkey-bin 	nsAccessibleTreeWalker::GetNextSibling 	accessible/src/base/nsAccessibleTreeWalker.cpp:199
7 	seamonkey-bin 	nsAccessible::CacheChildren 	accessible/src/base/nsAccessible.cpp:736
8 	seamonkey-bin 	nsHyperTextAccessible::CacheChildren 	accessible/src/html/nsHyperTextAccessible.cpp:216

Comment 6

[vazhavandan]

sounds like script engine is failing on a **** piece of code

Comment 7

[Marco Zehe (:MarcoZ)]

So are we dealing with a stack corruption here or something similar? I don#t see an obvious reason why we should be crashing at the line pointed to at frame #1.

Comment 8

[timeless]

no.

frame 0 is a tail call optimized call to strcmp() from PL_strcmp.

You're dealing with a bad pointer in one of the two arguments to PL_strcmp.

Comment 9

[alexander :surkov (:asurkov)]

Does it happen on trunk? If not do we need to care about 1.9.1?

Comment 10

[Marco Zehe (:MarcoZ)]

Hasn't seen activity in over half a year, and doesn't seem to be happening on trunk. The report references the end-of-life 1.9.1 branch. Closing WONTFIX.