150824 - crash after opening JS to new tab (Trunk M1 N7PR1)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Adam Hauner]

I used javascript link in article about M1 and it's crashing mozilla while
opened in new tab. Link is:
javascript:document.write(navigator.userAgent+'<BR>')

Repro:
1. open attachement
2. open it into new tab window

Actual result:
Browser is crashing, trunk build same as latest M100 build.

Just before crash appear this JS error on JS Console:
Error: uncaught exception: [Exception... "Unexpected error"  nsresult:
"0x8000ffff (NS_ERROR_UNEXPECTED)"  location: "JS frame ::
javascript:document.write(navigator.userAgent+'<BR>') :: <TOP_LEVEL> :: line 1"
 data: no]

Talkbacks (all on W2K) (Stephen, should I ask you for any?):
M100 (release) -> TB7219344M
M100 (2002061006) -> TB7219412Z
trunk (2002060908) -> TB7219467K

Comment 1

[Adam Hauner]

Attachment: testcase

Comment 2

[Adam Hauner]

Same crash with N7PR1 -> TB72227445Z

Comment 3

[Matthias Versen [:Matti]]

from my debug build :
00000001()
js_FinalizeObject(JSContext * 0x04f24c20, JSObject * 0x04b77738) line 1816 + 106 
bytes
js_GC(JSContext * 0x04f24c20, unsigned int 0) line 1283 + 11 bytes
js_ForceGC(JSContext * 0x04f24c20, unsigned int 0) line 980 + 13 bytes
JS_GC(JSContext * 0x04f24c20) line 1656 + 11 bytes
nsJSContext::Notify(nsJSContext * const 0x0500b5a8, nsITimer * 0x04f60150) line 
1595 + 13 bytes
nsTimerImpl::Fire() line 348
nsTimerManager::FireNextIdleTimer(nsTimerManager * const 0x03b43318) line 593
nsAppShell::Run(nsAppShell * const 0x0132c838) line 134
nsAppShellService::Run(nsAppShellService * const 0x0132c778) line 451
main1(int 2, char * * 0x00283160, nsISupports * 0x00000000) line 1456 + 32 bytes
main(int 2, char * * 0x00283160) line 1805 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e7d326()

-> Dom0

Comment 4

[Johnny Stenback (:jst)]

This is branch only as there is no "Open link in new tab" in the context menu
when you right-click on a javascript: URL with a trunk build. The first comment
in this bug says otherwise, but I can't see how that could be.

Comment 5

[Johnny Stenback (:jst)]

Ok, now I'm even more confused, I don't see how a javascript: URL can be opened
in a new tab on the branch either? What am I missing? Is this a Mozilla 1.0
thing, was it "fixed" by not making it possible to open javascript: URL's in new
tabs?

Comment 6

[Adam Hauner]

Johnny: Think about mouse middle click! (In Preferences | Navigator | Tabbed
browsing set 'Middle-click or control click of links in a Web Page'). And
Ctrl+Enter in URL Bar has same result.

Because I'm able to reproduce bug with actual nightbuild (2002061108 ->
TB7254363E), I'm changing back summary. Also tryed on W98 and Mozilla crash
quickly after closing tab with JS output.

Comment 7

[dmitry]

for me, on linux new tabs do load in the background, but on windows they do not.
a preference is indeed necessary to unify this.

Comment 8

[Johnny Stenback (:jst)]

Attachment: Proposed fix, don't delete refcounted objects, use the refcounting mechanism for controlling the lifetime...

Comment 9

[Johnny Stenback (:jst)]

The attached patch fixes the crash, but to fix this bug we should really make it
impossible to ever open a javascript: URL in a new tab (which would rarely work
in any case), just like we do in the context menu. I'll roll in this crash fix,
and then I'll assign to someone who can deal with the remaining issues...

Comment 10

[Johnny Stenback (:jst)]

Attachment: Same as above but also split out duplicated code.

Comment 11

[David Bradley]

Comment on attachment 87538 [details] [diff] [review]
Same as above but also split out duplicated code.

r=dbradley

Nothing like a good code consolidation, looks good to me

Comment 12

[David Bradley]

Comment on attachment 87538 [details] [diff] [review]
Same as above but also split out duplicated code.

Dang, didn't hit the stop button fast enough.

Comment 13

[Alec Flett]

Comment on attachment 87538 [details] [diff] [review]
Same as above but also split out duplicated code.

sr=alecf

Comment 14

[Johnny Stenback (:jst)]

Fix checked in.