266211 - crash in javascript window.open()

Status: RESOLVED DUPLICATE of bug 255372

(Firefox :: General, defect)

Description

[Gregory Bond]

User-Agent:       Mozilla/5.0 (X11; U; FreeBSD i386; rv:1.7.3) Gecko/20041020 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (X11; U; FreeBSD i386; rv:1.7.3) Gecko/20041020 Firefox/0.10.1

javascript window.open() whith non-empty last argument crashes the browser:

firefox-bin in free(): warning: chunk is already free
firefox-bin in free(): warning: chunk is already free
pure virtual method called
Abort trap (core dumped)


Reproducible: Always
Steps to Reproduce:
Browse the attached HTML
Actual Results:  
crash

Comment 1

[Gregory Bond]

Attachment: HTML that will crash my browser evey time

Works OK if the third argument to window.open() is not provided.

Distilled from the "desktop Scorebox" on www.cricinfo.org.

Comment 2

[Gregory Bond]

Interesting wrinkle:  It only crashes if you only have a single top-level window
open and javascript is trying to open a second.  If you have 2 or more windows
open, then javascript can open an extra one no problem.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Bug 255372 has a fix coming soon.

*** This bug has been marked as a duplicate of 255372 ***

*** This bug has been marked as a duplicate of 255372 ***

Comment 4

[:Gavin Sharp [email: [e-mail]]]

If this is not a dupe, please reopen.

Comment 5

[Gregory Bond]

Likewise, having another tab open when you click the link will work.  Openining
another tab, closing it then clicking will crash.

Opening another top-level window, closing it then clicking on the "crash" link
will work.

So to repeat the bug, you probably need to "copy link location" for the
attachment above, close Firefox, open a new one, middle-click to go to the URL
then click the Crash button.