40160 - Processing Javascript History url gives assertion

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect, P3)

Description

[Radha on family leave (not reading bugmail)]

While executing a JS history.back(), it appears that probably the current url in 
the channel is cancelled? To try, please goto,

1) http://www.testequity.com/nav2.phtml?type=new&mfg=Hewlett-Packard.
2) Select a product from the content area
3) After the product is displayed, click on the link, "<<return to Previous 
Page" in the top left corner.

4)This invokes a javascript:history.back(), it asserts in the following stack. 
aURL passed to nsWebShell::OnEndDocumentLoad() seems to have 
javascript:history.back() as the url. But the stack looks like it is 
in the process of cancelling previous loads. How did history.back() get in to 
the list of urls to be cancelled?. May be I'm interpreting this wrong. However, 
I need this cleared out to fix, 
http://bugzilla.mozilla.org/show_bug.cgi?id=21373

nsDebug::Assertion(const char * 0x00354218, const char * 0x003541e0, const char 
* 0x003541b4, int 1194) line 242 + 13 bytes
nsDebug::WarnIfFalse(const char * 0x00354218, const char * 0x003541e0, const 
char * 0x003541b4, int 1194) line 300 + 21 bytes
nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x02d825e0, nsIDocumentLoader * 
0x02d85280, nsIChannel * 0x02db0320, unsigned int 2152398850) line 1194 + 98 
bytes
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x02d85280, nsIChannel 
* 0x02db0320, unsigned int 2152398850) line 712
nsDocLoaderImpl::DocLoaderIsEmpty(unsigned int 2152398850) line 542
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x02d85284, nsIChannel * 
0x02db0320, nsISupports * 0x00000000, unsigned int 2152398850, const unsigned 
short * 0x00000000) line 485
nsLoadGroup::RemoveChannel(nsLoadGroup * const 0x02d85220, nsIChannel * 
0x02db0320, nsISupports * 0x00000000, unsigned int 2152398850, const unsigned 
short * 0x00000000) line 544 + 39 bytes
nsLoadGroup::Cancel(nsLoadGroup * const 0x02d85220, unsigned int 2152398850) 
line 225
nsDocLoaderImpl::Stop(nsDocLoaderImpl * const 0x02d85280) line 246 + 31 bytes
nsURILoader::Stop(nsURILoader * const 0x010603d0, nsISupports * 0x02d85298) line 
560 + 23 bytes
nsDocShell::StopLoad(nsDocShell * const 0x02d824c0) line 236
nsDocShell::StopCurrentLoads(nsDocShell * const 0x02d824c0) line 2611
nsDocShell::InternalLoad(nsDocShell * const 0x02d824c0, nsIURI * 0x032f3ba0, 
nsIURI * 0x00000000, const char * 0x00000000, nsIInputStream * 0x00000000, 
nsDocShell::loadType loadHistory) line 2283 + 15 bytes
nsDocShell::LoadHistoryEntry(nsDocShell * const 0x02d824c0, nsISHEntry * 
0x032fbea0) line 2792 + 39 bytes
nsDocShell::GoBack(nsDocShell * const 0x02d824cc) line 988 + 28 bytes
HistoryImpl::Back(HistoryImpl * const 0x02d736a4) line 147
HistoryBack(JSContext * 0x02d71730, JSObject * 0x02524680, unsigned int 0, long 
* 0x025bacf0, long * 0x0012f05c) line 224 + 12 bytes
js_Invoke(JSContext * 0x02d71730, unsigned int 0, unsigned int 0) line 686 + 23 
bytes
js_Interpret(JSContext * 0x02d71730, long * 0x0012fa0c) line 2485 + 15 bytes
js_Execute(JSContext * 0x02d71730, JSObject * 0x0243f450, JSScript * 0x02d73730, 
JSFunction * 0x00000000, JSStackFrame * 0x00000000, unsigned int 0, long * 
0x0012fa0c) line 857 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x02d71730, JSObject * 0x0243f450, 
JSPrincipals * 0x02d74390, const unsigned short * 0x0012faf4, unsigned int 14, 
const char * 0x00000000, unsigned int 0, long * 0x0012fa0c) line 2736 + 27 bytes
nsJSContext::EvaluateString(nsJSContext * const 0x02d718c0, const nsString & 
{...}, void * 0x0243f450, nsIPrincipal * 0x02d7438c, const char * 0x00000000, 
unsigned int 0, const char * 0x00000000, nsString & {...}, int * 0x023ffcd0) 
line 464 + 55 bytes
nsEvaluateStringProxy::EvaluateString(nsEvaluateStringProxy * const 0x02dafb70, 
char * * 0x023ffccc, int * 0x023ffcd0) line 167 + 64 bytes
XPTC_InvokeByIndex(nsISupports * 0x02dafb70, unsigned int 4, unsigned int 2, 
nsXPTCVariant * 0x02daf690) line 139
EventHandler(PLEvent * 0x02daf6e0) line 489 + 41 bytes
PL_HandleEvent(PLEvent * 0x02daf6e0) line 575 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01069b40) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00e408c6, unsigned int 49382, unsigned int 0, 
long 17210176) line 1030 + 9 bytes
USER32! 77e71820()

Comment 1

[rpotts (gone)]

here's what's happening...

All javascript URLs are implemented as nsSimpleURI which means that they only 
support a spec and scheme - nothing else.

Unfortunately, the webshell attempts to get the host from the javascript URL 
(inside of an NS_ENSURE_TRUE() macro).  This fails and we assert.

The fix is to re-factor the code so we only crack the URI to handle specific 
error states.

Comment 2

[Scott MacGregor]

I actually have a fix for this assertion in my tree. Rick, you can re-assign
this to me if you'd like.

Comment 3

[Scott MacGregor]

I'm going to take this bug from Rick as I have the fix in my tree.

Comment 4

[Scott MacGregor]

*** Bug 37532 has been marked as a duplicate of this bug. ***

Comment 5

[Scott MacGregor]

Nominating for beta2 so I can get permission to check this assertion fix into
the tree. Everyone and there mother is giving me a dup of this bug. And it's
just a couple lines to not assert.

Comment 6

[leger]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 7

[Scott MacGregor]

I fixed this yesterday and I thought I put a comment in the bug but it must not
have gone through.

Comment 8

[John Morrison]

*** Bug 43552 has been marked as a duplicate of this bug. ***

Comment 9

[John Morrison]

*** Bug 43552 has been marked as a duplicate of this bug. ***

Comment 10

[leger]

Adding verifyme keyword.

Comment 11

[leger]

Just tested these steps with Win32 2000-07-18-11 build.  works fine.  marking 
Verfified.