1290905 - Crash with JS code

Status: RESOLVED DUPLICATE of bug 1273364

(Firefox :: Untriaged, defect)

Description

[alexander]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.82 Safari/537.36

Steps to reproduce:

This could be reproduced on Mac OS only.

Just copy-paste this code to console:

    var req = Components.classes['@mozilla.org/xmlextras/xmlhttprequest;1'].createInstance();
    var url = "https://weg.de/"
    try{
        req.open('GET', url, true);
    }catch(ee){
        console.log(ee);
    }
    req.overrideMimeType('text/html');
    req.channel.loadFlags |= Ci.nsIRequest.LOAD_ANONYMOUS;

    req.onload = function(){

        if (req.status != 200 && req.status != 0 /* local files */){
            req.onerror();
        }
        else {
            if (req.responseURL != url) {
                if (decodeURI(decodeURI(req.responseURL)) != decodeURI(decodeURI(url))) {
                }
            }

            var document = Services.appShell.hiddenDOMWindow.document;
            var doc = document.implementation.createHTMLDocument("example");

            // The line that causes the crash.
            doc.documentElement.innerHTML = req.responseText;

        }
    }

    req.onerror = function() {

    }
    req.ontimeout = function() {

    }

    req.timeout = 10000;
    req.send(null);


Actual results:

Browser crashed


Expected results:

Browser must continue work without crashes.

Comment 1

[Mike Kaply [:mkaply]]

Here's a crash report:

https://crash-stats.mozilla.com/report/index/2e1ce71b-75c3-4321-9732-e62222160801

And it references another bug in Firefox 49 so this might have already been fixed. I'm checking.

Comment 2

[Mike Kaply [:mkaply]]

I've verified this is fixed in Firefox 49.

Comment 3

[alexander]

Thanks!