Trunk & M095 crashes at jsinterp.c, line 1283 [@ js_Interpret]

VERIFIED DUPLICATE of bug 106820

Status

()

Core
JavaScript Engine
--
critical
VERIFIED DUPLICATE of bug 106820
17 years ago
16 years ago

People

(Reporter: dbaron, Assigned: Kenton Hanson (gone))

Tracking

({crash, topcrash})

Trunk
x86
Windows 98
crash, topcrash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

17 years ago
Crashes in js_Interpret, at line 1277 of jsinterp.c, are showing up in talkback.
 The user comments are quite variable, although a number of them mention using
view source (although there are also crashes at other lines in the same
function, and I didn't check that the comments are for this crash).

Looking at the disassembly around the crash site, it looks like the problem is
that |pc| is 0x00000001 or 0x00000002, and is then dereferenced.  I looked at
three crash reports, and the EAX register was 0x00000001 in two cases and
0x00000002 in one case.  The disassembly around the crash site, with my
interpretation, is:

  op = (JSOp) *pc;
60d08a33 0fb600           movzx   eax,byte ptr [eax]      <==== CRASH HERE
60d08a36 8945ac           mov     [ebp-0x54],eax

  cs = &js_CodeSpec[op];
60d08a39 c1e004           shl     eax,0x4
60d08a3c 05a058d360       add     eax,0x60d358a0
60d08a41 8945b8           mov     [ebp-0x48],eax

  len = cs->length;
60d08a44 0fbe4008         movsx   eax,byte ptr [eax+0x8]
60d08a48 894590           mov     [ebp-0x70],eax

  JSTrapHandler handler = rt->interruptHandler;
60d08a4b 8b45a4           mov     eax,[ebp-0x5c]

Updated

17 years ago
Severity: normal → critical
Keywords: crash
(Reporter)

Updated

17 years ago
Keywords: topcrash
(Reporter)

Comment 1

17 years ago
Silly me, I forgot a stack.  Most of the stacks look like this (line numbers
from 8-27 build):

js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 1277]
js_Execute [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 988]
JS_ExecuteScript [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3211]
nsJSContext::ExecuteScript
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 766]
nsXULDocument::ExecuteScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5789]
nsXULDocument::LoadScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5600]
nsXULDocument::ResumeWalk
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5378]
nsXULDocument::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5747]
nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 123]
nsJARChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 582]
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 162]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 428]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1395]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1712] 


but some of them have the following between nsXULDocument::ResumeWalk and
PL_HandleEvent instead (lines from 8-25 build):

nsXULDocument::ResumeWalk
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5362]
nsXULDocument::EndLoad
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 1638]
XULContentSinkImpl::DidBuildModel
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULContentSink.cpp, line
519]
CWellFormedDTD::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 314]
nsParser::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1615]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp,
line 2143]
nsParser::OnStopRequest
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2734]
nsDocumentOpenInfo::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 254]
nsJARChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 582]
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 162]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
...

Comment 2

17 years ago
Reassigning to khanson -
Assignee: rogerl → khanson
(Reporter)

Comment 3

17 years ago
I just went through the last 15 reports of this crash.  pc was 1 in 9 cases, it
was 2 in 5 cases, and 3 in 1 case.

Could this be caused by setting low bit flags on a pointer value without
null-checking it, or null-checking it without masking out low bits used as flags?
(Assignee)

Comment 4

17 years ago
David,

Could you please provide an example for reproducing this bug.

=Kenton=
(Reporter)

Comment 5

17 years ago
I don't have an example of how to reproduce.  However, it might be easier to
figure out the problem if we knew when it started.  However, I can't find
talkback reports going back before 8-5, and it started sometime between 0.9.3
and 8-5.

Comment 6

17 years ago
Here are some user comments from today's MozillaTrunk Talkback report:

(34624669)
Comments: Crashed as I clicked on View source.
     (34532364)	URL: www.2seb.de/alternative
(34532364)
Comments: Crashed as I wanted to view a page source
     (34451472)	Comments: View > Page Source
     (34449029)	URL: http://www.travelonline.co.nz
(34449029)
Comments: Clicked on 'click here' for more details for travel competition....
     (34322940)	URL: www.auto-motor-sport.de

The latest stacktrace for this crash also shows that the crash location is now at 
jsinterp.c  line 1240:

Stack Trace: 

	 js_Interpret
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 1240]
	 js_Execute
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 988]
	 JS_ExecuteScript
[d:\builds\seamonkey\mozilla\js\src\jsapi.c  line 3211]
	 nsJSContext::ExecuteScript
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp  line 766]
	 nsXULDocument::ExecuteScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 5789]
	 nsXULDocument::LoadScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 5600]
	 nsXULDocument::ResumeWalk
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 5378]
	 nsXULDocument::OnStreamComplete
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 5747]
	 nsStreamLoader::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp  line 123]
	 nsJARChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp  line 582]
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 162]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]

Summary: crashes at jsinterp.c, line 1277 [@ js_Interpret] → Trunk crashes at jsinterp.c, line 1240 (was line 1277) [@ js_Interpret]

Comment 7

17 years ago
I did some digging and this is what I found regarding the histroy of this crash:

There are crashes with a js_Interpret stack signature for Netscape6.10B1,
Netscape6.10 RTM and but the stack is different and the crash is at a different
location than around jsinterp.c, line 1240.  There are also crashes on Linux
MozillaTrunk builds, but their stack looks different as well, so this is
probably a Win32 specific crash. 

We only store data for the MozillaTrunk for 30 days, so the oldest entry I could
find was this one:

Stack Signature   js_Interpret d3538661
Bug ID
Trigger Time 2001-08-01 10:57:46
Email Address
User Comments
Build ID 2001080106
Product ID MozillaTrunk
Platform ID Win32
Trigger Reason Access violation
Stack Trace
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 1275]
js_Execute [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 988]
JS_ExecuteScript [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3200]
nsJSContext::ExecuteScript
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 759]
nsXULDocument::ExecuteScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5721]
nsXULDocument::LoadScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5532]
nsXULDocument::ResumeWalk
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 5310]
nsXULDocument::CachedChromeStreamListener::OnStopRequest
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp, line 6677]
nsDocumentOpenInfo::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 248]
nsCachedChromeChannel::HandleStopLoadEvent
[d:\builds\seamonkey\mozilla\rdf\chrome\src\nsChromeProtocolHandler.cpp, line 438]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072] 

It is quite possible that this crash existed before 8/1, but we don't have any
Talkback data to back that.  If anyone wants to take a look at all the data we
have for these crashes, go to:
http://climate/reports/searchstacksignature.cfm?stacksig=js_Interpret
(Reporter)

Comment 8

17 years ago
When I found the crashes at line 1277, I saw a few interspersed reports of
crashes at line 1240, but the more common ones were at line 1277, and I didn't
see a date trend.  I also remember thinking that the disassembly / registers for
the line 1240 crashes didn't make sense.

Comment 9

17 years ago
FWIW, I have been uable to crash on WinNT with a 2001-08-23 debug build
while following any of the scenarios at 2001-08-29 17:01 above...
This still looks like an attempt to execute a precompiled ("brutally shared")
XUL script whose script object has been GC'd unexpectedly.  That suggests a bug
in rooting the script object.  dbaron, any thoughts since we last chatted about
this bug?

/be
See bug 98207, possible dup with more reproducible instructions.

/be
Forward-duping as threatened.

/be

*** This bug has been marked as a duplicate of 98207 ***
Status: NEW → RESOLVED
Last Resolved: 16 years ago
Resolution: --- → DUPLICATE

Comment 13

16 years ago
Marking Verified Duplicate - 
Status: RESOLVED → VERIFIED
(Reporter)

Comment 14

16 years ago
I'm going to reopen this bug because, although the reproducable instructions no
longer cause a crash, this crash is still showing up in trunk builds.  It's now
at jsinterp.c, line 1283, and the analysis of the disassembly I noted above
still holds.

User comments:

 (35667112)	Comments: had a browser open  clicked on the email button to open my email and
it crashed.
     (35598421)	Comments: I was running choffman's browser buster in one window  and also
typing into a text field in another navigator window. Turbo mode was enabled.
     (35492909)	Comments: OS reboot
     (35472837)	URL: www.heise.de/...
     (35472837)	Comments: tried to open mail by clicking on mail icon in component bar
(twice) while a browser window was asking for username/password to login to a
protected site.
     (35461936)	Comments: opening mail
     (35388465)	Comments: Getting a channel list off DalNet in Chatzilla.  Chatzilla really
needs a Channel view/search dialog...
     (35351742)	URL:
ftp://ftp.mozilla.org/pub/mozilla/nightly/latest/mozilla-win32-installer-sea.exe
     (35223643)	Comments: Started mail...
Status: VERIFIED → REOPENED
Resolution: DUPLICATE → ---
Summary: Trunk crashes at jsinterp.c, line 1240 (was line 1277) [@ js_Interpret] → Trunk crashes at jsinterp.c, line 1283 [@ js_Interpret]
(Reporter)

Comment 15

16 years ago
Oops, the comment mentioning chatzilla for report 35388465 was a different stack
and a different line in js_Interpret.  All the others were this stack and this line.

Comment 16

16 years ago
To gain more understanding, I looked these incidents up (except 35388465).
Here is a typical pattern leading to the top of the trace:


js_Interpret                       [jsinterp.c, line 1283] 
js_Execute                         [jsinterp.c, line 991] 
JS_ExecuteScript                   [jsapi.c, line 3213] 
nsJSContext::ExecuteScript         [nsJSEnvironment.cpp, line 773] 
nsXULDocument::ExecuteScript       [nsXULDocument.cpp, line 5850] 
nsXULDocument::LoadScript          [nsXULDocument.cpp, line 5642] 
nsXULDocument::ResumeWalk          [nsXULDocument.cpp, line 5420] 
nsXULDocument::OnStreamComplete    [nsXULDocument.cpp, line 5808] 
nsStreamLoader::OnStopRequest      [nsStreamLoader.cpp, line 123] 
nsJARChannel::OnStopRequest        [nsJARChannel.cpp, line 613] 
nsOnStopRequestEvent::HandleEvent  [nsRequestObserverProxy.cpp, line 162] 
PL_HandleEvent                     [xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents            [xpcom\threads\plevent.c, line 524] 
_md_EventReceiverProc              [xpcom\threads\plevent.c, line 1072]




I will attach the full text below. Isn't it odd that all the traces
involve nsJARChannel::OnStopRequest - perhaps the fault lies there? 

Comment 17

16 years ago
Created attachment 50581 [details]
Talkback stack traces (7)

Comment 18

16 years ago
FWIW, these are the current bugs mentioning nsJARChannel::OnStopRequest


http://bugzilla.mozilla.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NEW&bu
g_status=ASSIGNED&bug_status=REOPENED&email1=&emailtype1=substring&emailassigned
_to1=1&email2=&emailtype2=substring&emailreporter2=1&bugidtype=include&bug_id=&c
hangedin=&votes=&chfieldfrom=&chfieldto=Now&chfieldvalue=&short_desc=&short_desc
_type=allwordssubstr&long_desc=nsJARChannel%3A%3AOnStopRequest&long_desc_type=al
lwordssubstr&bug_file_loc=&bug_file_loc_type=allwordssubstr&status_whiteboard=&s
tatus_whiteboard_type=allwordssubstr&keywords=&keywords_type=anywords&field0-0-0
=noop&type0-0-0=noop&value0-0-0=&cmdtype=doit&newqueryname=&order=Reuse+same+sor
t+as+last+time

Comment 19

16 years ago
for now sticking that into the url field (it'll be in bug activity if we ever 
get a better url...) did we decide if JAR was thread safe?

Comment 20

16 years ago
Here is the latest source file for this crash and some recent user comments and
urls from the MozillaTrunk topcrash report:

Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line : 1283

     (36138495)	Comments: launching it 
     (36134041)	Comments: when I select "Mail/News"   mozilla crashed.
     (36118943)	URL: http://www.espn.com
(36102322)
Comments: Editing bookmarks while browsing
     (36098906)	URL: http://www.espn.com
(36098906)
Comments: Opening Mail...
     (36074572)	URL: http://www.mozillazine.org
(36074572)
Comments: I was adding a bookmark when mozilla crashed.
     (36066747)	Comments: was already slow / blocking showing normal webpages  and finally
crashed when i tryed to "file bookmark..." the website.
     (36038514)	Comments: browser just launchedtried to launch mail/news
     (36034922)	Comments: when start up computer   then mozilla missed startup(turbo mode)
     (36008031)	Comments: View/Page source
     (35989315)	URL: http://www.espn.com
(35989315)
Comments: Running VNC Java client  and opened mail....
     (35987522)	Comments: clicked on the mail-icon to start the mail-app
     (35974786)	URL: http://www.ams.dk
(35974786)
Comments: Attempting to "view source"
     (35960950)	Comments: mozilla just launchedtried to start chat client
     (35951119)	URL: http://wine.dataparty.no
(35951119)
Comments: From a browser window  I clicked on the message icon to launch messenger.
     (35949105)	Comments: I see a page has watermark property and I tried to edit it with
composer 
     (35907246)	Comments: booting computer and clicking once on the mizilla icon in the task
tray (quick start is enabled)
     (35900434)	URL: www.hackbusters.net
(35869257)
Comments: launching composer
     (35856667)	Comments: trying to connect to an efnet server in the IRCChat program of Mozilla
     (35834259)	URL: www.virginblue.com.au
(35834259)
Comments: clicked on mail-icon to open mail-app
     (35760812)	URL: www.mozillazine.org
(35760812)
Comments: Clicked the lower left mail-evelope icon to start mail-app...
crashed.quickstart enabled. one window. mozillazine was first site to be loaded

Comment 21

16 years ago
Showing some improvement (source: Topcrashers by build date)

SIGNATURE    10-08 10-07 10-06 10-05 10-04 10-03 10-02 10-01 09-30 09-29 09-28
js_Interpret   1     0     4     7     4     7     0     9     3     0     15
Anyone working on this?  dbaron, any thoughts?

/be

Comment 23

16 years ago
Here is the latest source file and user comments and urls from Talkback data for
the MozillaTrunk:

Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line : 1291
     (36732467)	Comments: Tried to start Mail  by clicking the status bar button
     (36701343)	URL: www.mozillazine.org
(36701343)
Comments: click on mail icon in lower left corner
     (36651051)	Comments: Testing bugzilla bug 104584
     (36639320)	Comments: buggiest build for ages........ good luck....
     (36542575)	URL: www.voodooextreme.com
(36535624)
URL: http://www.memoireracines.qc.ca/festival.htm
(36535403)
URL: http://www.cdw.com
(36535403)
Comments: I had a window open to mozillazine  then I did some other stuff  then
I went back to the mozillazine window and clicked on the mail app and it crashed.
     (36523672)	Comments: Attempted to open Mail  by clicking the icon in the status bar
     (36412633)	Comments: view page source
     (36407081)	Comments: clicked on mail-icon to start mail-app
     (36377234)	Comments: attempted to launch mail 

This is also a topcrasher for Mozilla 0.9.5.  I'm not sure if all of the crashes
with the js_Interpret stack signature are the same, but here is the Talkback
data for all of them:

js_Interpret   63
			 97293 	 REOP 	  	 khanson@netscape.com ---
			 98207 	 VERI 	 FIXE 	 brendan@mozilla.org mozilla0.9.4 
BBID range: 36640814 - 36758306
Min/Max Seconds since last crash: 12 - 161565
Min/Max Runtime: 12 - 161565
Crash data range: 2001-10-13 to 2001-10-16
Build ID range: 2001101120 to 2001101120
Keyword List : mail(6), start(5), browser(5), 
Stack Trace: 

	 js_Interpret
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 1291]
	 js_Execute
[d:\builds\seamonkey\mozilla\js\src\jsinterp.c  line 991]
	 JS_ExecuteScript
[d:\builds\seamonkey\mozilla\js\src\jsapi.c  line 3235]
	 nsJSContext::ExecuteScript
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp  line 790]
	 nsXULDocument::ExecuteScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 5870]
	 nsXULDocument::LoadScript
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 5662]
	 nsXULDocument::ResumeWalk
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 5440]
	 nsXULDocument::EndLoad
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULDocument.cpp  line 1664]
	 XULContentSinkImpl::DidBuildModel
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULContentSink.cpp  line
536]
	 CWellFormedDTD::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp  line 329]
	 nsParser::DidBuildModel
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 1424]
	 nsParser::ResumeParse
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 1948]
	 nsParser::OnStopRequest
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp  line 2543]
	 nsDocumentOpenInfo::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp  line 272]
	 nsJARChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp  line 614]
	 nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 177]
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 591]
	 PL_ProcessPendingEvents
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 524]
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1072]
	 nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp  line 457]
	 main1
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1305]
	 main
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1622]
	 WinMain
[d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp  line 1640]
	 WinMainCRTStartup()
	 KERNEL32.DLL + 0x17d08 (0x77e97d08)
 
 	Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line : 1291
     (36758306)	Comments: Opened moz whilst windows was still startng up. Quick start is
enabled.
     (36757883)	Comments: Did a Google search for "Linux IDS"  results page appeared  search
sidebar expanded and started to load. Crash occured.
     (36757800)	Comments: Switched to mail/news
     (36756257)	Comments: searching in google.com
     (36755021)	URL: http://www.google.com/
(36755021)
Comments: I was at http://slashdot.org/ and had just typed
http://www.google.com/ to go search for something  pressed enter to load google
 and the browser crashed.
     (36755019)	Comments: I started the Browser offline and worked in the Composer. After I
changed two sites  I went online. Then I tryed to start the Mail program over
the Taskbar inside the Browser. The program crashed.
     (36753909)	Comments: First attempt at using Chatzilla
     (36752553)	Comments: Was trying to type a URL in the address bar
     (36750795)	Comments: using the IRC client (listing all channels on efnet)
     (36742213)	Comments: opening a sidebar tab while using browser tabs
     (36742207)	Comments: using mozgest to view source
     (36733448)	Comments: while /list-ing irc channels
     (36731053)	Comments: tried to view source on an .xul file
     (36717454)	Comments: Started browser. Clicked on mail icon to open mail program 
browser crashed
     (36712677)	URL: www.gstats.org
(36712677)
Comments: While loading a *.pdf document and opening the mail mozilla 0.95crashed
     (36708761)	URL: http://www.scriptweb.ch/main.html
(36707066)
URL: www.pauldenbesten.nl
(36707066)
Comments: clicking one of the menu options to view a new page
     (36705964)	Comments: Browsing the History Tab
     (36699032)	Comments: IRC  receiving /list from efnet
     (36690808)	Comments: Selected Javascript debugger from the Tasks menu.  Had the tabbed
interface running.
     (36687908)	URL: www.scriptweb.ch
(36685945)
URL: http://www.mozilla.org/start/
(36685945)
Comments: Opened "New Navigator Window"  then selected "Open Web Location".
Seems like I'm unable to reproduce the problem  though.
     (36680541)	URL: www.mozilla.org/start
(36680541)
Comments: clicking on the IRC Chipzilla link
     (36679214)	Comments: listing channels in IRC
     (36673435)	Comments: I start the browser  but the tool bar pic is not show and the char
is large  and I close it and restart  The crash happend.
     (36653388)	Comments: list command in IRC with a lot of output
     (36649387)	URL: http://www.scriptweb.ch/main.html
(36647684)
Comments: Opening Mail & Newsgroups
     (36645320)	Comments: This page causes the crash:http://www.scriptweb.ch/main.html
(36644397)
URL: http://www.scriptweb.ch/main.html
(36642116)
Comments: Closed subfolder in IMAP-mail account
Summary: Trunk crashes at jsinterp.c, line 1283 [@ js_Interpret] → Trunk & M095 crashes at jsinterp.c, line 1283 [@ js_Interpret]

Comment 24

16 years ago
I'm going to dupe this against bug 106820. The stack traces in the two
bugs look the same to me, and the other bug has more useful information.
I do not believe it is JS Engine that is causing this - 

*** This bug has been marked as a duplicate of 106820 ***
Status: REOPENED → RESOLVED
Last Resolved: 16 years ago16 years ago
Resolution: --- → DUPLICATE

Comment 25

16 years ago
Marking Verified -
Status: RESOLVED → VERIFIED
Crash Signature: [@ js_Interpret]
You need to log in before you can comment on or make changes to this bug.