110931 - N620 crash [@ nsDSURIContentListener::CanHandleContent]

Status: RESOLVED DUPLICATE of bug 67721

(Core :: DOM: Navigation, defect)

Description

[greer]

Looking at the stack this is likely a dupe of 67721. However, this crash is on a
Linux platform and only appears in N620 data.
 
Stack Trace: 

         nsDSURIContentListener::CanHandleContent()
         nsDSURIContentListener::IsPreferred()
         nsDSURIContentListener::IsPreferred()
         nsURILoader::ShouldHandleContent()
         nsURILoader::DispatchContent()
         nsDocumentOpenInfo::DispatchContent()
         nsDocumentOpenInfo::OnStartRequest()
         nsHttpChannel::ProcessNormal()
         nsHttpChannel::ProcessResponse()
         nsHttpChannel::OnStartRequest()
         nsOnStartRequestEvent::HandleEvent()
         nsARequestObserverEvent::HandlePLEvent()
         PL_HandleEvent()
         PL_ProcessPendingEvents()
         nsEventQueueImpl::ProcessPendingEvents()
         event_processor_callback()
         our_gdk_io_invoke()
         libglib-1.2.so.0 + 0xec40 (0x4034cc40)
         libglib-1.2.so.0 + 0x10308 (0x4034e308)
         libglib-1.2.so.0 + 0x10913 (0x4034e913)
         libglib-1.2.so.0 + 0x10aac (0x4034eaac)
         libgtk-1.2.so.0 + 0x8d7e7 (0x402717e7)
         nsAppShell::Run()
         nsAppShellService::Run()
         main1()
         main()
         libc.so.6 + 0x1d2eb (0x404882eb)     (38162292)        URL:
http://slashdot.org
     (38162292) Comments: I went to an ftp site to download am rpm. After
downloading it and
continuing browsing other sites the brower would occasionally ybring me right
back to the ftp site.
After this happened a few times it just crashed.
     (38020633) Comments: loadin plugin then netscape is off every time 
     (37995385) URL: www.aruba.it
     (37995385) Comments: just clicked on
     (37841516) Comments: at yahoo.com - netscape folded up when i closed an
address book -
thankheavens had saved the letter draft!!!!@!!

Comment 1

[Adam Lock]

The stack trace indicates that nsDSURIContentListener::IsPreferred is called on
one docshell listener which in turn calls IsPreferred on a parent docshell
listener. The parent docshell listener may be crashing inside
nsDSURIContentListener::DoContent either because:

1. It is an invalid object (i.e. has been destroyed or bad ptr)
2. mDocShell member variable is nsnull or invalid
3. domWindow is nsnull or invalid

I will submit a patch which puts some additional pointer checks into the code
but there is little else that can be done without further information.

Comment 2

[Adam Lock]

Ack, I meant to look at CanHandleContent, not DoContent. Similar reasons apply:

1. Bad aContentType
2. Bad mCatMgr

I'll submit a patch with additional pointer checking.

Comment 3

[Adam Lock]

Duping against bug 67721.

*** This bug has been marked as a duplicate of 67721 ***