705820 - Crash on function "mozjs.?isWrapper@JSObject@@QBE_NXZ" when visiting a gmail account.

Status: RESOLVED DUPLICATE of bug 631784

(Firefox :: General, defect)

Description

[ImmortalOblivion]

Wouldn't surprise me if this was an open bug as it's been happening to me for a while now but I searched and didn't find one open, so here I am...

The application crashes randomly when navigating to a gmail web account through any means, typing in the address, clicking bookmarks, clicking google homepage gmail button, clicking the email icon on the bottom of the google talk GUI... what ever the method of navigation doesn't seem to matter. The exact steps and criterion to reproduce this bug are unclear to me and I have tried everything. The only thing I know about the crash pattern is that the crash seams to happen more often immediately after the crash has happened once already. The only features that are unorthodox for a normal PC setup are possibly the gmail experimental feature called "inbox preview" and that I have noscript installed. The crash may also have something to do with Google talk (I'm using 1.0.0.104 since google STILL hasn't updated there software yet). 

In any case, for me, just visiting gmail over and over again with any method and a "vanilla" install of Firefox and Windows Vista Ultimate on a 64bit system is enough to cause the crash. "Vanilla" meaning, uninstalling noscript, uninstalling google talk, and uninstalling Firefox, Restarting, then reinstalling Firefox. Using internet search engines for the phrase "gmail Firefox crash" and phrases like it return nothing relevant. Except for an old bug in Firefox that was supposed to be fixed already. And the workaround for that old bug (uninstall google talk) does not work for this.

Debugging of the program showed the following. The address in EIP is wrong of course,(thank you ASLR)

=============================================================================
Failed on the function called at offset 0xAF800 in mozjs.dll

Exception thrown...
Attempting to move data pointed to by ECX + 4 into EAX where ECX = 00000000

Registers...

EAX 00000000
ECX 00000000
EDX 00000004
EBX 05F24A80
ESP 0025FF14
EBP 0025FFE8
ESI 071322E0
EDI 00000000

EIP 6F17ECDO mozjs.?isWrapper@JSObject@@QBE_NXZ

instruction at EIP...
8B41 04		MOV EAX,DWORD PTR DS:[ECX+4]
===============================================================================

I'm not the greatest programer but it seems to me a simple zero checking and a jump to some sort of retry or error handler at the function called would probably fix this bug.

This has been going on for a while now without getting fixed and I'm starting to wonder if it ever will... C-mon guys (:-/) Am I going to have to switch browsers? PS, I highly doubt it's my system, but weirder shi..stuff has happened. my two cents.

Comment 1

[Scoobidiver (away)]

Does it happen in safe mode (see http://support.mozilla.com/kb/Safe%20Mode)?
with a new profile (see http://support.mozilla.com/kb/Managing-profiles)?
Can you provide the crash ID in about:crashes?

Comment 2

[ImmortalOblivion]

(In reply to Scoobidiver from comment #1)

> "Can you provide the crash ID in about:crashes?"
Crash ID: d875d593-ab80-4876-9bf3-2f3882111130  
(I guess there are a lot of people with this problem after all)

> "Does it happen in safe mode?"
It does *not* seem to crash when in safe mode, no. But I need to do it about a billion more times to be sure. The crash is highly elusive to begin with.

> "[does it crash] with a new profile?" 
Not sure yet, Will try that soon and get back to you...