User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 I just updated to 3.6 last night and all of the sudden Firefox crashes when uploading a 105 MB PDF file by using a JavaScript technique where the target is pointed to an iframe. It worked fine before I upgraded. Reproducible: Always Steps to Reproduce: 1. Submit PDF file over 100 MB 2. Target an iframe Actual Results: Crashes. Expected Results: Uploaded the PDF file. I've made a crash report: http://crash-stats.mozilla.com/report/index/bbe4025c-80ca-4581-823e-94c292100121

Signature NS_CopySegmentToBuffer(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) UUID bbe4025c-80ca-4581-823e-94c292100121 Time 2010-01-21 14:11:59.222976 Uptime 574 Last Crash 581 seconds before submission Product Firefox Version 3.6 Build ID 20100115132715 Branch 1.9.2 OS Mac OS X OS Version 10.6.2 10C540 CPU x86 CPU Info GenuineIntel family 6 model 15 stepping 11 Crash Reason EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE Crash Address 0x21084016 User Comments Processor Notes Crashing Thread Frame Module Signature [Expand] Source 0 @0xffff1299 1 @0xffff0875 2 XUL NS_CopySegmentToBuffer xpcom/io/nsStreamUtils.cpp:763 3 XUL nsBufferedInputStream::ReadSegments netwerk/base/src/nsBufferedStreams.cpp:331 4 XUL nsBufferedInputStream::Read netwerk/base/src/nsBufferedStreams.cpp:314 5 XUL nsMultiplexInputStream::Read xpcom/io/nsMultiplexInputStream.cpp:207 6 XUL nsMultiplexInputStream::Read xpcom/io/nsMultiplexInputStream.cpp:207 7 XUL nsBinaryInputStream::Read xpcom/io/nsBinaryStream.cpp:357 8 XUL nsBinaryInputStream::ReadBytes xpcom/io/nsBinaryStream.cpp:732 9 XUL NS_InvokeByIndex_P xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:179 10 XUL XPCWrappedNative::CallMethod js/src/xpconnect/src/xpcwrappednative.cpp:2721 11 XUL XPC_WN_CallMethod js/src/xpconnect/src/xpcwrappednativejsops.cpp:1740 12 libmozjs.dylib js_Invoke js/src/jsinterp.cpp:1360 13 libmozjs.dylib js_Interpret js/src/jsops.cpp:2240 14 libmozjs.dylib js_Invoke js/src/jsinterp.cpp:1368 15 libmozjs.dylib js_fun_apply js/src/jsfun.cpp:2046 16 libmozjs.dylib js_Interpret js/src/jsops.cpp:2208 17 libmozjs.dylib js_Invoke js/src/jsinterp.cpp:1368 18 XUL nsXPCWrappedJSClass::CallMethod js/src/xpconnect/src/xpcwrappedjsclass.cpp:1696 19 XUL nsXPCWrappedJS::CallMethod js/src/xpconnect/src/xpcwrappedjs.cpp:570 20 XUL PrepareAndDispatch xpcom/reflect/xptcall/src/md/unix/xptcstubs_unixish_x86.cpp:93 21 XUL PrepareAndDispatch 22 XUL nsHttpActivityEvent::Run netwerk/protocol/http/src/nsHttpActivityDistributor.cpp:70 23 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:527 24 XUL NS_ProcessPendingEvents_P nsThreadUtils.cpp:200 25 XUL nsBaseAppShell::NativeEventCallback widget/src/xpwidgets/nsBaseAppShell.cpp:121 26 XUL nsAppShell::ProcessGeckoEvents widget/src/cocoa/nsAppShell.mm:494 27 CoreFoundation __CFRunLoopDoSources0 28 CoreFoundation __CFRunLoopRun 29 CoreFoundation CFRunLoopRunSpecific 30 CoreFoundation CFRunLoopRunInMode 31 HIToolbox RunCurrentEventLoopInMode 32 HIToolbox ReceiveNextEventCommon 33 HIToolbox BlockUntilNextEventMatchingListInMode 34 AppKit _DPSNextEvent 35 AppKit -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 36 AppKit -[NSApplication run] 37 XUL nsAppShell::Run widget/src/cocoa/nsAppShell.mm:847 38 XUL nsAppStartup::Run toolkit/components/startup/src/nsAppStartup.cpp:182 39 XUL XRE_main toolkit/xre/nsAppRunner.cpp:3505 40 firefox-bin main browser/app/nsBrowserApp.cpp:158 41 firefox-bin firefox-bin@0x1541 42 firefox-bin firefox-bin@0x1468 43 @0x2 Reporter: the top two frames are not recognized... 2 XUL NS_CopySegmentToBuffer xpcom/io/nsStreamUtils.cpp:763 763 memcpy(&toBuf[offset], buffer, count); This doesn't make sense. If you can reproduce this, could you try downloading a shark build (with symbols): http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-trunk/firefox-3.7a1pre.en-US.mac-shark.dmg And I guess crashing with it. I think i'm looking for the OS X crash reporter to tell me something (not sure what).