83299 - Browser crashed while loading the site [@ RecycleTree]

Status: VERIFIED DUPLICATE of bug 83532

(Core :: JavaScript Engine, defect)

Description

[Pavel]

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
BuildID:    2001053004

While loading the site www.themarker.co.il browser produces access violation. 
Does not happen in 0.9 milestone or netscape 6.01.
Stack trace: (no symbols)
JS3250! 60cc9b35()
JS3250! 60cc95b9()
JS3250! 60ca3ec1()
JS3250! 60ca3e6f()
JS3250! 60ca4605()
JSDOM! 605429c5()
GKCONTENT! 01c7d9cc()
GKCONTENT! 01c7d777()
GKCONTENT! 01c7e143()
NECKO! 60787540()
NECKO! 6078d6c3()
NECKO! 6078c6ad()
XPCOM! 60eba4dc()
SETUPAPI! 778b0c24()


Reproducible: Always
Steps to Reproduce:
1. Open http://www.themarker.co.il

Comment 1

[Ferdinand]

seeing this with cvs 200153009 on winMe too

Comment 2

[Ferdinand]

Attachment: testcase, crashes over 50% of the time

Comment 3

[Ferdinand]

added a quick testcase. this still crashes for me, but not always.
locally, it crashed aboutr half of the times, or more.
the crash is caused by a javascript function declaration, which was in
http://www.themarker.co.il/ibo/script/archive.js originally 

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I can't reproduce this crash myself, but it's showing up as a top crash in
talkback reports.  Moving to Javascript Engine.  The stack showing up is either

RecycleTree [d:\builds\seamonkey\mozilla\js\src\jsparse.c line 231]
Statements [d:\builds\seamonkey\mozilla\js\src\jsparse.c line 916]
js_CompileTokenStream [d:\builds\seamonkey\mozilla\js\src\jsparse.c line 392]
CompileTokenStream [d:\builds\seamonkey\mozilla\js\src\jsapi.c line 2786]
JS_CompileUCScriptForPrincipals [d:\builds\seamonkey\mozilla\js\src\jsapi.c line
2864]
JS_EvaluateUCScriptForPrincipals [d:\builds\seamonkey\mozilla\js\src\jsapi.c
line 3271]

or

RecycleTree [d:\builds\seamonkey\mozilla\js\src\jsparse.c line 202]
0x81e58778
js_CompileTokenStream [d:\builds\seamonkey\mozilla\js\src\jsparse.c line 392]
CompileTokenStream [d:\builds\seamonkey\mozilla\js\src\jsapi.c line 2786]
JS_CompileUCScriptForPrincipals [d:\builds\seamonkey\mozilla\js\src\jsapi.c line
2864]
JS_EvaluateUCScriptForPrincipals [d:\builds\seamonkey\mozilla\js\src\jsapi.c
line 3271] 

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Other URLs on which this crash is reported are:

http://www.imdb.com/
http://www.mydigiguide.com/
http://www.myspace.com/
http://www.themarker.com/ (same as above?)
http://www.mydigiguide.com/dgx/wbl.dll

Comment 6

[Phil Schwartau]

This bug has identical stack traces to bug 83532, which involves 
the use of negative cases in switch() statements. As indicated in
that bug, the crash is not 100% predictable and depends on the context.


Sure enough, in Ferdinand's testcase attached here, we find:

function checkday()
{
 var d = new Date();
             
 document.arc_form.recToDD.selectedIndex = d.getDate();
 document.arc_form.recToMM.selectedIndex = d.getMonth()+1;
 year =d.getFullYear()-2000;

 switch (year) 
 {
   case -1 :
     year = 3;
     break;
   case 0 :
     year = 2;
     break;
   case 1 :
     year = 1;
     break;
 } 


         etc. 
         etc.



*** This bug has been marked as a duplicate of 83532 ***

Comment 7

[Phil Schwartau]

Marking Verified - thanks to all for a nice catch on this -