250758 - Firefox crashes when trying to open an URL in a new tab [@ ntdll.dll - js_NewObjectMap ]

Status: RESOLVED FIXED

(Firefox :: General, defect, P2)

Description

[Francois Ingelrest]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1

The link which is given in the post should open the website www.clubic.com
This works fine when left-clicking, but Firefox crashes when middle-clicking on
it to open the link in a new tab

Reproducible: Always
Steps to Reproduce:
1. Go to
http://forum.clubic.com/forum2.php3?cat=17&post=7846&config=&cache=cache&sondage=&p=1&trash=&subcat=&owntopic=0&page=1#t76124
2. There is a link is this post to
http://www.tbirdtheyuri.est.le.maître.du.monde.clubic.com/
3. Middle-click on this link

Actual Results:  
Firefox crashes

Comment 1

[Francois Ingelrest]

Attachment: Contains the url that mames Firefox crash

The letter î seems to be involved in the problem, if it is replaced by a simple
i, Firefox does not crash anymore

Comment 2

[Richard Corbin]

Confirmed using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.9.1

Comment 3

[Adam Hauner]

Francois, Richard: Could you provide TalkBack incident ID?

Comment 4

[Francois Ingelrest]

I'm sorry about not knowing this, but where do I find it? I got the talkback
dialog when it crashes, so I fill the fields and click on send, but I don't see
any ID?

Comment 5

[Adam Hauner]

To get the Talkback ID's go to your Firefox directory and go to components/,
there start talkback.exe, it'll give you a list with the IDs. Thank's a lot.

Comment 6

[Francois Ingelrest]

Ok thanks. It tells me TB304186E.

Comment 7

[Adam Hauner]

ntdll.dll + 0x80dd (0x77f480dd)
msvcrt.dll + 0x1ac14 (0x77bfac14)
msvcrt.dll + 0x1ac2a (0x77bfac2a)
js_NewObjectMap 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c,
line 1792]
js_NewObject 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c,
line 1884]
JS_NewObject 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c,
line 2098]
XPCWrappedNative::Init 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 740]
XPCWrappedNative::GetNewOrUsed 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 378]
XPCConvert::NativeInterface2JSObject 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcconvert.cpp,
line 1065]
nsXPConnect::WrapNative 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/nsXPConnect.cpp,
line 568]
nsXPCComponents_Classes::NewResolve 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpccomponents.cpp,
line 689]
XPC_WN_Helper_NewResolve 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 929]
js_LookupProperty 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c,
line 2423]
js_GetProperty 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsobj.c,
line 2611]
js_Interpret 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2802]
js_Invoke 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 958]
js_Interpret 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 2973]
js_Invoke 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 958]
js_InternalInvoke 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1035]
JS_CallFunctionValue 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c,
line 3607]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1297]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 184]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1434]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1512]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2841]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2860]
nsXULElement::HandleChromeEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3984]
GlobalWindowImpl::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 914]
nsDocument::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 3736]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1996]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1990]
nsGenericElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1990]
nsGenericHTMLElement::HandleDOMEventForAnchors 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 1361]
nsHTMLLinkElement::HandleDOMEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/html/content/src/nsHTMLLinkElement.cpp,
line 335]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6036]
PresShell::HandleEventWithTarget 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5992]
nsEventStateManager::CheckForAndDispatchClick 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 2905]
nsEventStateManager::PostHandleEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventStateManager.cpp,
line 1905]
PresShell::HandleEventInternal 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6088]
PresShell::HandleEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5929]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2285]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2025]
HandleEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 79]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x3a50 (0x77d13a50)
USER32.dll + 0x3b1f (0x77d13b1f)
USER32.dll + 0x3d79 (0x77d13d79)
USER32.dll + 0x3ddf (0x77d13ddf)
nsAppShellService::Run 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[c:/builds/tinderbox/firefox-0.9.1/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x214c7 (0x77e614c7)

Comment 8

[Blake Ross]

Will have a fix for this tomorrow.

Comment 9

[Blake Ross]

Fixed.

I filed bug 253761 to fix the checkLoadURIStr function.