From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; m17) Gecko/20000718 BuildID: 2000071810 At the provided url http://members.xoom.it/devotip/ there is a little javascript which is working with NN4.7 and IE5. It's not working with mozilla and the bitmap used in it is displayed at the bottom of the page. Reproducible: Always Steps to Reproduce: 1.upen the url 2.wait for the page to load 3.move the mouse Actual Results: The applet is not executed because of an error, see javascript: and the bitmap used by it is at the bottom of the page Expected Results: Animated string following the mouse cursor

*** Bug 45942 has been marked as a duplicate of this bug. ***

Confirmed on Linux 2000071910 as well.

I am actually crashing on WinNT and Linux when trying the given URL, http://members.xoom.it/devotip/ Using builds that might be a few hours too old, but for the record: Mozilla tip build 2000-07-18 8PM Pacific Time on WinNT Mozilla tip build 2000-07-19 11AM Pacific Time on Linux

devotip@tiscalinet.it, you mentioned that "The applet is not executed because of an error, see javascript:" Would you be able to provide what that error says, as I cannot access the URL at the moment? Thank you -

The reported error is dots[i].obj has no properties Url:http://members.xoom.it/_XOOM/devotip/index.html line 133

This website uses HTML that is no longer supported: document.all document.id For example, the error "dots[i].obj has no properties" is occurring because line 133 of the HTML is doing things like this: this.obj = eval("document.dot3"); The HTML element it's trying to refer to was defined as <DIV id=dot3 style= etc. etc. > The new W3 standards require the use of document.getElementById in order to access an HTML element by its id. Bug 45333 is another example. Bug 22249 is also relevant to this web page in its use of the .style property. For guidance on W3 standards and the differences between Navigator 4.x and Mozilla, see http://sites.netscape.net/ekrock/standards.html For Nav4 info, see http://developer.netscape.com/docs/technote/dynhtml/csspapi/csspapi.html However, I am concerned that this page is actually crashing. Adding crash keyword and cc'ing Brendan for his advice on the crash. (stack traces above). Is this a JS Engine problem?

Crashes still occurring with: Mozilla tip builds 2000-07-20 1PM Pacific Time on WinNT, Linux

Phil, what is scope->count? What does *scope look like, using p and p/x in gdb? This sounds like a bug in the engine, or very near it (perhaps in a JS API usage error). /be

Here is what I found: #0 0x403624e1 in __kill () from /lib/libc.so.6 #1 0x402b01eb in raise (sig=6) at signals.c:64 #2 0x40363868 in abort () at ../sysdeps/generic/abort.c:88 #3 0x40220c7b in JS_Assert (s=0x4022aae0 "scope->count > 0", file=0x4022a940 "jslock.c", ln=666) at jsutil.c:174 #4 0x401e8a6e in js_UnlockScope (cx=0x87160b8, scope=0x8b4b720) at jslock.c:666 #5 0x401e8c67 in js_UnlockObj (cx=0x87160b8, obj=0x8989c08) at jslock.c:731 #6 0x401f4c6e in js_SetProperty (cx=0x87160b8, obj=0x8989c08, id=142178992, vp=0xbffff2ac) at jsobj.c:2244 #7 0x401dff89 in js_Interpret (cx=0x87160b8, result=0xbffff48c) at jsinterp.c:2386 #8 0x401d1afc in js_Execute (cx=0x87160b8, chain=0x85ceec8, script=0x8c17380, fun=0x0, down=0x0, special=0, result=0xbffff48c) at jsinterp.c:887 #9 0x401a3f01 in JS_EvaluateUCScriptForPrincipals (cx=0x87160b8, obj=0x85ceec8, principals=0x8920958, chars=0xbffff640, length=11, filename=0x8b8a048 "http://members.xoom.it/devotip/", lineno=77, rval=0xbffff48c) at jsapi.c:2770 #10 0x405a73be in ?? () from /data/phil/mozilla/dist/bin/./libjsdom.so #11 0x405c5650 in ?? () from /data/phil/mozilla/dist/bin/./libjsdom.so #12 0x405c6159 in ?? () from /data/phil/mozilla/dist/bin/./libjsdom.so #13 0x40feb6c3 in nsTimerGtk::FireTimeout (this=0x8b80878) at nsTimerGtk.cpp:182 #14 0x40feb8f4 in process_timers (array=0x8208408) at nsTimerGtk.cpp:254 #15 0x40feb9fc in TimerCallbackFunc (data=0x8207be8) at nsTimerGtk.cpp:281 #16 0x40baba04 in g_timeout_dispatch () from /usr/lib/libglib-1.2.so.0 #17 0x40baabe6 in g_main_dispatch () from /usr/lib/libglib-1.2.so.0 #18 0x40bab1a1 in g_main_iterate () from /usr/lib/libglib-1.2.so.0 #19 0x40bab341 in g_main_run () from /usr/lib/libglib-1.2.so.0 #20 0x40ad2209 in gtk_main () from /usr/lib/libgtk-1.2.so.0 #21 0x409df05a in nsAppShell::Run (this=0x80ea750) at nsAppShell.cpp:335 #22 0x40514d34 in nsAppShellService::Run (this=0x8118cc8) at nsAppShellService.cpp:386 #23 0x80534d5 in main1 (argc=1, argv=0xbffffb34, nativeApp=0x0) at nsAppRunner.cpp:913 #24 0x8053b9e in main (argc=1, argv=0xbffffb34) at nsAppRunner.cpp:1093 (gdb) up #1 0x402b01eb in raise (sig=6) at signals.c:64 64 in signals.c (gdb) up #2 0x40363868 in abort () at ../sysdeps/generic/abort.c:88 88 ../sysdeps/generic/abort.c: No such file or directory. (gdb) up #3 0x40220c7b in JS_Assert (s=0x4022aae0 "scope->count > 0", file=0x4022a940 "jslock.c", ln=666) at jsutil.c:174 174 abort(); (gdb) up #4 0x401e8a6e in js_UnlockScope (cx=0x87160b8, scope=0x8b4b720) at jslock.c:666 666 JS_ASSERT(scope->count > 0); (gdb) p scope->count $8 = 0 (gdb) p/x scope->count $9 = 0x0 (gdb) p scope $10 = (JSScope *) 0x8b4b720 (gdb) p/x scope $11 = 0x8b4b720 (gdb) p *scope $12 = {map = {nrefs = 1, ops = 0x40232980, nslots = 5, freeslot = 5}, object = 0x8989c08, props = 0x8b4b7d0, proptail = 0x8b4b7ec, ops = 0x40233b50, data = 0x8b4b7f8, lock = {owner = 0, fat = 0x8b4b778}, count = 0, file = {0x4022b120 "jsobj.c", 0x0, 0x0, 0x0}, line = {2064, 0, 0, 0}} (gdb) p/x *scope $13 = {map = {nrefs = 0x1, ops = 0x40232980, nslots = 0x5, freeslot = 0x5}, object = 0x8989c08, props = 0x8b4b7d0, proptail = 0x8b4b7ec, ops = 0x40233b50, data = 0x8b4b7f8, lock = {owner = 0x0, fat = 0x8b4b778}, count = 0x0, file = {0x4022b120, 0x0, 0x0, 0x0}, line = {0x810, 0x0, 0x0, 0x0}}

I'm a dumbass, I perpetrated a double-unlock leaving another object locked. Patch coming up. /be

Cc'ing potential code reviewers. /be

Fix checked in. /be

Using Mozilla tip builds 2000-08-09 on WinNT, 2000-08-10 on Linux. Verifying fixed - I no longer crash on http://members.xoom.it/devotip/