289405 - ASSERTION: unexpected write access check: '!(mode & JSACC_WRITE)'

Status: RESOLVED DUPLICATE of bug 289074

(Core :: Security: CAPS, defect)

Description

[Martin Mokrejs]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050407
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050407

I use cvs head. I've re-synced my about 2 days old copy and see new assertion
here on Gentoo linux i386/gcc. It appears already during startup of the browser
(empty startup page):

###!!! ASSERTION: unexpected write access check: '!(mode & JSACC_WRITE)', file
nsScriptSecurityManager.cpp, line 456
Break: at file nsScriptSecurityManager.cpp, line 456


The message comes from caps/src/nsScriptSecurityManager.cpp, but am unable to
find out which bugzilla component it is. :(

$ gcc --version
gcc (GCC) 3.4.3-20050110 (Gentoo Linux 3.4.3.20050110-r1, ssp-3.4.3.20050110-0,
pie-8.7.7)
[cut]
$ uname -a
Linux aquarius 2.6.11.5 #3 Wed Mar 23 21:50:02 CET 2005 i686 Intel(R) Pentium(R)
4 CPU 3.00GHz GenuineIntel GNU/Linux
$ 


Reproducible: Always

Comment 1

[Dainis Jonitis]

Bug 289074 caused this.

Comment 2

[Martin Mokrejs]

I cannot browse that bug, bugzilla says I have no permission to it ... strange.
Anyway, some more details.


(gdb) 
Continuing.
[New Thread 32771 (LWP 1693)]
[New Thread 49156 (LWP 1694)]
++DOMWINDOW == 1
++WEBSHELL == 2
++DOMWINDOW == 2
[New Thread 65541 (LWP 1695)]
[New Thread 81926 (LWP 1696)]
[New Thread 98311 (LWP 1697)]
Note: styleverifytree is disabled
Note: frameverifytree is disabled
Note: verifyreflow is disabled
JavaScript error: chrome://cookie/content/cookieNavigatorOverlay.xul, line 51: 
redeclaration of const nsIPermissionManager
WARNING: GetDefaultCharsetForLocale: need to add multi locale support, file 
nsUNIXCharset.cpp, line 188
WARNING: GetDefaultCharsetForLocale: need to add multi locale support, file 
nsUNIXCharset.cpp, line 188
###!!! ASSERTION: unexpected write access check: '!(mode & JSACC_WRITE)', file 
nsScriptSecurityManager.cpp, line 456
Break: at file nsScriptSecurityManager.cpp, line 456
Suspending process; attach with the debugger.

Program received signal SIGSTOP, Stopped (signal).
[Switching to Thread 49156 (LWP 1694)]
0xb7d65636 in nanosleep () from /lib/libpthread.so.0
(gdb)      
(gdb) info threads
  8 Thread 98311 (LWP 1697)  0xb7d65636 in nanosleep () from /lib/libpthread.so.
0
  7 Thread 81926 (LWP 1696)  0xb7d65636 in nanosleep () from /lib/libpthread.so.
0
  6 Thread 65541 (LWP 1695)  0xb7d65636 in nanosleep () from /lib/libpthread.so.
0
* 5 Thread 49156 (LWP 1694)  0xb7d65636 in nanosleep () from /lib/libpthread.so.
0
  4 Thread 32771 (LWP 1693)  0xb7d65636 in nanosleep () from /lib/libpthread.so.
0
  3 Thread 16386 (LWP 4733)  0xb763ddec in poll () from /lib/libc.so.6
  2 Thread 32769 (LWP 4732)  0xb763ddec in poll () from /lib/libc.so.6
  1 Thread 16384 (LWP 4726)  0xb75a74a1 in kill () from /lib/libc.so.6
(gdb)
(gdb) thread 1
[Switching to thread 1 (Thread 16384 (LWP 4726))]#0  0xb75a74a1 in kill () from 
/lib/libc.so.6
(gdb) where
#0  0xb75a74a1 in kill () from /lib/libc.so.6
#1  0xb7f998ab in nsDebugImpl::Break (this=0x81c1b90, aFile=0xb6fe511a 
"nsScriptSecurityManager.cpp", aLine=456)
    at nsDebugImpl.cpp:333
#2  0xb7f99793 in nsDebugImpl::Assertion (this=0x81c1b90, aStr=0xb6fe52c7 
"unexpected write access check", 
    aExpr=0xb6fe52b1 "!(mode & JSACC_WRITE)", aFile=0xb6fe511a 
"nsScriptSecurityManager.cpp", aLine=456)
    at nsDebugImpl.cpp:294
#3  0xb7f120b8 in nsDebug::Assertion (aStr=0xb6fe52c7 "unexpected write access 
check", 
    aExpr=0xb6fe52b1 "!(mode & JSACC_WRITE)", aFile=0xb6fe511a 
"nsScriptSecurityManager.cpp", aLine=456) at nsDebug.cpp:108
#4  0xb6fd237c in nsScriptSecurityManager::CheckObjectAccess (cx=0x80d9730, 
obj=0x838ea08, id=137943676, mode=JSACC_WRITE, 
    vp=0xbfffae3c) at nsScriptSecurityManager.cpp:456
#5  0xb7e5debd in js_InternalGetOrSet (cx=0x80d9730, obj=0x838ea08, 
id=137968176, fval=137948104, mode=JSACC_WRITE, argc=1, 
    argv=0xbfffb514, rval=0xbfffb514) at jsinterp.c:1446
#6  0xb7e8578b in js_SetProperty (cx=0x80d9730, obj=0x838ea08, id=137968176, 
vp=0xbfffb514) at jsobj.c:2877
#7  0xb7e6c03f in js_Interpret (cx=0x80d9730, pc=0x8850eac "6", 
result=0xbfffb67c) at jsinterp.c:3425
#8  0xb7e5d84e in js_Invoke (cx=0x80d9730, argc=0, flags=2) at jsinterp.c:1334
#9  0xb7e5dc26 in js_InternalInvoke (cx=0x80d9730, obj=0x838ea08, 
fval=137948560, flags=0, argc=0, argv=0x0, rval=0xbfffb820)
    at jsinterp.c:1411
#10 0xb7e28ad8 in JS_CallFunctionValue (cx=0x80d9730, obj=0x838ea08, 
fval=137948560, argc=0, argv=0x0, rval=0xbfffb820)
    at jsapi.c:3804
#11 0xb68337da in nsXBLProtoImplAnonymousMethod::Execute (this=0x88455f0, 
aBoundElement=0x8856f58)
    at nsXBLProtoImplMethod.cpp:333
#12 0xb6826e71 in nsXBLPrototypeBinding::BindingAttached (this=0x88450c8, 
aBoundElement=0x8856f58)
    at nsXBLPrototypeBinding.cpp:390
#13 0xb68246fb in nsXBLBinding::ExecuteAttachedHandler (this=0x88443e0) at 
nsXBLBinding.cpp:768
#14 0xb68d62c6 in nsElementSH::PostCreate (this=0x8457828, wrapper=0x8840758, 
cx=0x80d9730, obj=0x838ea08)
    at nsDOMClassInfo.cpp:5695
#15 0xb736a1bb in XPCWrappedNative::GetNewOrUsed (ccx=@0xbfffbbe0, 
Object=0x8856f74, Scope=0x82e3aa0, Interface=0x80d2a90, 
    resultWrapper=0xbfffbb6c) at xpcwrappednative.cpp:433
#16 0xb7348f32 in XPCConvert::NativeInterface2JSObject (ccx=@0xbfffbbe0, 
dest=0xbfffbcc0, src=0x8856f74, iid=0xb6a162f8, 
    scope=0x81c6960, pErr=0xbfffbbdc) at xpcconvert.cpp:1060
#17 0xb73306e2 in nsXPConnect::WrapNative (this=0x80d0268, aJSContext=0x80d9730, 
aScope=0x81c6960, aCOMObj=0x8856f74, 
    aIID=@0xb6a162f8, _retval=0xbfffbcc0) at nsXPConnect.cpp:566
#18 0xb68c6d26 in nsDOMClassInfo::WrapNative (cx=0x80d9730, scope=0x81c6960, 
native=0x8856f74, aIID=@0xb6a162f8, 
    vp=0xbfffc454) at nsDOMClassInfo.cpp:1254
#19 0xb68d6664 in nsArraySH::GetProperty (this=0x882c3e0, wrapper=0x88405e8, 
cx=0x80d9730, obj=0x838e9f8, id=5, 
    vp=0xbfffc454, _retval=0xbfffbda0) at nsDOMClassInfo.cpp:5775
#20 0xb7376c75 in XPC_WN_Helper_GetProperty (cx=0x80d9730, obj=0x838e9f8, 
idval=5, vp=0xbfffc454)
    at xpcwrappednativejsops.cpp:811
#21 0xb7e84dbf in js_GetProperty (cx=0x80d9730, obj=0x838e9f8, id=5, 
vp=0xbfffc454) at jsobj.c:2733
#22 0xb7e6c7e6 in js_Interpret (cx=0x80d9730, pc=0x8840442 "7\002°
a\001c\004f\n", result=0xbfffc550) at jsinterp.c:3431
#23 0xb7e5e2d6 in js_Execute (cx=0x80d9730, chain=0x838df98, script=0x8840408, 
down=0x0, flags=0, result=0xbfffc63c)
    at jsinterp.c:1544
#24 0xb7e288b2 in JS_EvaluateUCScriptForPrincipals (cx=0x80d9730, obj=0x838df98, 
principals=0x82176f4, chars=0x885f178, 
    length=41, filename=0xbfffc718 "chrome://global/content/bindings/tabbrowser.
xml", lineno=128, rval=0xbfffc63c)
    at jsapi.c:3739
#25 0xb6894440 in nsJSContext::EvaluateStringWithValue (this=0x82428d8, 
aScript=@0xbfffc6c0, aScopeObject=0x838df98, 
    aPrincipal=0x0, aURL=0xbfffc718 "chrome://global/content/bindings/
tabbrowser.xml", aLineNo=128, aVersion=0x0, 
    aRetValue=0xbfffc6f8, aIsUndefined=0xbfffc6f4) at nsJSEnvironment.cpp:848
#26 0xb68340a1 in nsXBLProtoImplField::InstallMember (this=0x885f138, 
aContext=0x82428d8, aBoundElement=0x85db2b0, 
    aScriptObject=0x838df98, aTargetClassObject=0x838dfb8, aClassStr=@0x885ecb8) 
at nsXBLProtoImplField.cpp:126
#27 0xb6834384 in nsXBLProtoImpl::InstallImplementation (this=0x885ecb8, 
aBinding=0x8853b48, aBoundElement=0x85db2b0)
    at nsXBLProtoImpl.cpp:89
#28 0xb6826fa5 in nsXBLPrototypeBinding::InstallImplementation (this=0x8853b48, 
aBoundElement=0x85db2b0)
    at nsXBLPrototypeBinding.cpp:442
#29 0xb6824593 in nsXBLBinding::InstallImplementation (this=0x8853eb0) at 
nsXBLBinding.cpp:733
#30 0xb683d761 in nsXBLService::LoadBindings (this=0x842fa10, 
aContent=0x85db2b0, aURL=0x840e560, aAugmentFlag=0, 
    aBinding=0xbfffca70, aResolveStyle=0xbfffca68) at nsXBLService.cpp:629
#31 0xb644e6f0 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db2b0, 
    aParentFrame=0x88241f4, aTag=0x8302d58, aNameSpaceID=9, 
aStyleContext=0x88242b0, aFrameItems=@0xbfffcd18, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7558
#32 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db2b0, 
    aParentFrame=0x88241f4, aFrameItems=@0xbfffcd18) at nsCSSFrameConstructor.
cpp:7515
#33 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aFrame=0x88241f4, aCanHaveGeneratedContent=0, aFrameItems=@0xbfffcd18, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
#34 0xb644aeed in nsCSSFrameConstructor::ConstructXULFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aParentFrame=0x882412c, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x8824198, aFrameItems=@0xbfffd1d8, aXBLBaseTag=0, 
    aHasPseudoParent=0, aHaltProcessing=@0xbfffcea8) at nsCSSFrameConstructor.
cpp:6208
#35 0xb644eb12 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aParentFrame=0x882412c, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x8824198, aFrameItems=@0xbfffd1d8, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7630
#36 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aParentFrame=0x882412c, aFrameItems=@0xbfffd1d8) at nsCSSFrameConstructor.
cpp:7515
#37 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
    aFrame=0x882412c, aCanHaveGeneratedContent=0, aFrameItems=@0xbfffd1d8, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
#38 0xb644aeed in nsCSSFrameConstructor::ConstructXULFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
    aParentFrame=0x8823dcc, aTag=0x81335c0, aNameSpaceID=9, 
aStyleContext=0x8823fc0, aFrameItems=@0xbfffd698, aXBLBaseTag=0, 
    aHasPseudoParent=0, aHaltProcessing=@0xbfffd368) at nsCSSFrameConstructor.
cpp:6208
#39 0xb644eb12 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
    aParentFrame=0x8823dcc, aTag=0x81335c0, aNameSpaceID=9, 
aStyleContext=0x8823fc0, aFrameItems=@0xbfffd698, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7630
#40 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
    aParentFrame=0x8823dcc, aFrameItems=@0xbfffd698) at nsCSSFrameConstructor.
cpp:7515
#41 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aFrame=0x8823dcc, aCanHaveGeneratedContent=0, aFrameItems=@0xbfffd698, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
#42 0xb644aeed in nsCSSFrameConstructor::ConstructXULFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aParentFrame=0x859bcdc, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x859bc24, aFrameItems=@0xbfffdab8, aXBLBaseTag=0, 
    aHasPseudoParent=0, aHaltProcessing=@0xbfffd828) at nsCSSFrameConstructor.
cpp:6208
#43 0xb644eb12 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aParentFrame=0x859bcdc, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x859bc24, aFrameItems=@0xbfffdab8, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7630
#44 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aParentFrame=0x859bcdc, aFrameItems=@0xbfffdab8) at nsCSSFrameConstructor.
cpp:7515
#45 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x829c5a0, 
    aFrame=0x859bcdc, aCanHaveGeneratedContent=1, aFrameItems=@0xbfffdab8, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
#46 0xb6446aa2 in nsCSSFrameConstructor::ConstructDocElementFrame 
(this=0x83fa220, aState=@0xbfffdc60, 
    aDocElement=0x829c5a0, aParentFrame=0x859ba98, aNewFrame=0xbfffdd44) at 
nsCSSFrameConstructor.cpp:4415
#47 0xb6452597 in nsCSSFrameConstructor::ContentInserted (this=0x83fa220, 
aContainer=0x0, aContainerFrame=0x0, 
    aChild=0x829c5a0, aIndexInContainer=0, aFrameState=0x0, 
aInReinsertContent=0) at nsCSSFrameConstructor.cpp:9025
#48 0xb64a1bbf in PresShell::InitialReflow (this=0x859ae80, aWidth=17, 
aHeight=17) at nsPresShell.cpp:2803
#49 0xb6866311 in nsXULDocument::StartLayout (this=0x8433410) at nsXULDocument.
cpp:2151
#50 0xb6869fce in nsXULDocument::ResumeWalk (this=0x8433410) at nsXULDocument.
cpp:3176
#51 0xb686f65d in nsXULDocument::CachedChromeStreamListener::OnStopRequest 
(this=0x857b140, request=0x82feb08, aContext=0x0, 
    aStatus=0) at nsXULDocument.cpp:4377
#52 0xb6d012b8 in nsDocumentOpenInfo::OnStopRequest (this=0x8302248, 
request=0x82feb08, aCtxt=0x0, aStatus=0)
    at nsURILoader.cpp:366
#53 0xb611cb08 in nsCachedChromeChannel::HandleStopLoadEvent (aEvent=0x859c948) 
at nsChromeProtocolHandler.cpp:476
#54 0xb7f87019 in PL_HandleEvent (self=0x859c948) at plevent.c:698
#55 0xb7f86ece in PL_ProcessPendingEvents (self=0x81e7918) at plevent.c:633
#56 0xb7f8a208 in nsEventQueueImpl::ProcessPendingEvents (this=0x81e78e0) at 
nsEventQueue.cpp:418
#57 0xb4da5fb4 in event_processor_callback (source=0x83026a8, condition=G_IO_IN, 
data=0x81e78e0) at nsAppShell.cpp:67
#58 0xb78d90f1 in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#59 0x083026a8 in ?? ()
#60 0x00000001 in ?? ()
#61 0x081e78e0 in ?? ()
#62 0xb7d600f9 in pthread_mutex_unlock () from /lib/libpthread.so.0
#63 0xb78a1a7a in g_source_remove_poll () from /usr/lib/libglib-2.0.so.0
#64 0x08301890 in ?? ()
#65 0xb4da5f90 in nsBaseWidget::FreeNativeData () at nsISupportsImpl.h:60
Previous frame inner to this frame (corrupt stack?)
(gdb) 



(gdb) bt full
#0  0xb75a74a1 in kill () from /lib/libc.so.6
No symbol table info available.
#1  0xb7f998ab in nsDebugImpl::Break (this=0x81c1b90, aFile=0xb6fe511a 
"nsScriptSecurityManager.cpp", aLine=456)
    at nsDebugImpl.cpp:333
        assertBehavior = 0xbffff495 "suspend"
#2  0xb7f99793 in nsDebugImpl::Assertion (this=0x81c1b90, aStr=0xb6fe52c7 
"unexpected write access check", 
    aExpr=0xb6fe52b1 "!(mode & JSACC_WRITE)", aFile=0xb6fe511a 
"nsScriptSecurityManager.cpp", aLine=456)
    at nsDebugImpl.cpp:294
        buf = "###!!! ASSERTION: unexpected write access check: '!(mode & 
JSACC_WRITE)', file nsScriptSecurityManager.cpp, line 
456\000xE\bØ©ÿ¿á\000Ö·\030¹\035\bj\000Ö·(dà·DÀû·\b¹\035\b\224øý·è©ÿ¿\201\231û·¨«
ÿ¿\021\000\001\000ø©ÿ¿\036\020â·\b¹\035\b\220«ÿ¿\bªÿ¿\214\024ü·\220«ÿ¿ô\177Ö·"..
.
#3  0xb7f120b8 in nsDebug::Assertion (aStr=0xb6fe52c7 "unexpected write access 
check", 
    aExpr=0xb6fe52b1 "!(mode & JSACC_WRITE)", aFile=0xb6fe511a 
"nsScriptSecurityManager.cpp", aLine=456) at nsDebug.cpp:108
No locals.
#4  0xb6fd237c in nsScriptSecurityManager::CheckObjectAccess (cx=0x80d9730, 
obj=0x838ea08, id=137943676, mode=JSACC_WRITE, 
    vp=0xbfffae3c) at nsScriptSecurityManager.cpp:456
        ssm = (nsScriptSecurityManager *) 0x81dcc18
        target = (JSObject *) 0x838ebc8
        rv = 6
#5  0xb7e5debd in js_InternalGetOrSet (cx=0x80d9730, obj=0x838ea08, 
id=137968176, fval=137948104, mode=JSACC_WRITE, argc=1, 
    argv=0xbfffb514, rval=0xbfffb514) at jsinterp.c:1446
No locals.
#6  0xb7e8578b in js_SetProperty (cx=0x80d9730, obj=0x838ea08, id=137968176, 
vp=0xbfffb514) at jsobj.c:2877
        pobj = (JSObject *) 0x838eba8
        prop = (JSProperty *) 0x8848664
        sprop = (JSScopeProperty *) 0x8848664
        scope = (JSScope *) 0x8847cd8
        attrs = 113
        flags = 0
        shortid = 0
        clasp = (JSClass *) 0x8218354
        getter = 0xb7e22d3f <JS_PropertyStub>
        setter = 0xb7376ca6 <XPC_WN_Helper_SetProperty>
        pval = 0
        slot = 0
#7  0xb7e6c03f in js_Interpret (cx=0x80d9730, pc=0x8850eac "6", 
result=0xbfffb67c) at jsinterp.c:3425
        scope_ = (JSScope *) 0x339
        rt = (JSRuntime *) 0x80c5da8
        fp = (JSStackFrame *) 0xbfffb690
        script = (JSScript *) 0x8850e48
        inlineCallCount = 0
        obj = (JSObject *) 0x838ea08
        obj2 = (JSObject *) 0x0
        proto = (JSObject *) 0x0
        parent = (JSObject *) 0x2
        currentVersion = JSVERSION_DEFAULT
        originalVersion = JSVERSION_DEFAULT
---Type <return> to continue, or q <return> to quit---
        onbranch = 0xb6892890 <nsJSContext::DOMBranchCallback(JSContext*, 
JSScript*)>
        ok = 1
        cond = 1
        interruptHandler = 0
        depth = 4
        len = 3
        sp = (jsval *) 0x886bc5c
        newsp = (jsval *) 0x886bc44
        mark = (void *) 0x886bc44
        endpc = (jsbytecode *) 0x8850ed5 "¸\200"
        pc2 = (jsbytecode *) 0x1 <Address 0x1 out of bounds>
        op = JSOP_SETPROP
        op2 = 3074101744
        cs = (const JSCodeSpec *) 0xb7ee7140
        atom = (JSAtom *) 0x8393a30
        argc = 2
        slot = 16384
        attrs = 135070192
        vp = (jsval *) 0x886bc54
        lval = 137947656
        rval = 1
        ltmp = 135070208
        rtmp = -1210711839
        id = 137968176
        withobj = (JSObject *) 0xbfffb870
        origobj = (JSObject *) 0xb6a162f8
        propobj = (JSObject *) 0xb739e5ca
        iter_state = -1210699767
        prop = (JSProperty *) 0x80d01f0
        sprop = (JSScopeProperty *) 0x0
        str = (JSString *) 0xb7d67ff4
        str2 = (JSString *) 0xb7d630e2
        i = 138621968
        j = 134747000
        d = -3.1772782139759664e-39
        d2 = -5.5048068478918243e-39
        clasp = (JSClass *) 0xb6841ab7
        funclasp = (JSClass *) 0xbfffb4e8
        fun = (JSFunction *) 0x8868fa0
        type = JSTYPE_VOID
        tracefp = (FILE *) 0x0
        ida = (JSIdArray *) 0xbfffb4c8
        low = 136955296
        high = 138623060
        off = -1232845552
        npairs = -1073761080
        match = -1230263856
---Type <return> to continue, or q <return> to quit---
        getter = 0x8806974
        setter = 0xb7f9e8fc <nsTraceRefcntImpl::LogAddRef(void*, unsigned int, 
char const*, unsigned int)+12>
        foreach = 0
        stackDummy = -1224842336
#8  0xb7e5d84e in js_Invoke (cx=0x80d9730, argc=0, flags=2) at jsinterp.c:1334
        mark = (void *) 0x886bc40
        fp = (JSStackFrame *) 0xbfffc530
        frame = {callobj = 0x0, argsobj = 0x0, varobj = 0x0, script = 0x8850e48, 
fun = 0x8868d20, thisp = 0x838ea08, 
  argc = 0, argv = 0x886bc40, rval = -2147483647, nvars = 1, vars = 0x886bc40, 
down = 0xbfffc530, annotation = 0x0, 
  scopeChain = 0x838ea08, pc = 0x8850eac "6", sp = 0x886bc5c, spbase = 
0x886bc54, sharpDepth = 0, sharpArray = 0x0, 
  flags = 2, dormantNext = 0x0, xmlNamespace = 0x0}
        sp = (jsval *) 0x886bc44
        newsp = (jsval *) 0x886bc40
        limit = (jsval *) 0xb7fdf894
        vp = (jsval *) 0x886bc38
        v = -2147483647
        funobj = (JSObject *) 0x838ed90
        parent = (JSObject *) 0x838ea08
        thisp = (JSObject *) 0x838ea08
        ok = 1
        clasp = (JSClass *) 0xb7ee96e0
        ops = (JSObjectOps *) 0xb7fdf894
        native = 0
        fun = (JSFunction *) 0x8868d20
        script = (JSScript *) 0x8850e48
        minargs = 0
        nvars = 1
        nslots = -1
        nalloc = 136410864
        surplus = 0
        hook = 0xb739e8d3 <jsd_FunctionCallHook>
        hookData = (void *) 0x80c8af0
#9  0xb7e5dc26 in js_InternalInvoke (cx=0x80d9730, obj=0x838ea08, 
fval=137948560, flags=0, argc=0, argv=0x0, rval=0xbfffb820)
    at jsinterp.c:1411
        fp = (JSStackFrame *) 0xbfffc530
        oldfp = (JSStackFrame *) 0xbfffc530
        frame = {callobj = 0x81dcc40, argsobj = 0xb6fe7364, varobj = 0xbfffb7e8, 
script = 0xb6fd5cb9, fun = 0xbfffb7d0, 
  thisp = 0x81dcc40, argc = 137948560, argv = 0xbfffb7d0, rval = 135076160, 
nvars = 3086874772, vars = 0xbfffb788, 
  down = 0x0, annotation = 0x8081378, scopeChain = 0xbfffb830, pc = 0x80d1940 
"(\n9·\\\n9·", sp = 0xb7f11e96, 
  spbase = 0xb6a8152c, sharpDepth = 3064703440, sharpArray = 0xbfffb7a8, flags = 
3059648794, dormantNext = 0xbfffb830, 
  xmlNamespace = 0x80d1940}
        oldsp = (jsval *) 0x886bc30
        sp = (jsval *) 0x886bc40
        mark = (void *) 0x886bc30
        i = 0
        ok = -1224929718
#10 0xb7e28ad8 in JS_CallFunctionValue (cx=0x80d9730, obj=0x838ea08, 
fval=137948560, argc=0, argv=0x0, rval=0xbfffb820)
---Type <return> to continue, or q <return> to quit---
    at jsapi.c:3804
No locals.
#11 0xb68337da in nsXBLProtoImplAnonymousMethod::Execute (this=0x88455f0, 
aBoundElement=0x8856f58)
    at nsXBLProtoImplMethod.cpp:333
        retval = 142962520
        document = (class nsIDocument *) 0x8433410
        cx = (JSContext *) 0x80d9730
        rv = 0
        cxstack = {mRawPtr = 0x80d1940}
        thisObject = (JSObject *) 0x838ea08
        method = (JSObject *) 0x838ed90
        global = (class nsIScriptGlobalObject *) 0x8226c48
        context = {mRawPtr = 0x82428d8}
        globalObject = (JSObject *) 0x81c6960
        wrapper = {mRawPtr = 0x8840758}
        ok = 1
#12 0xb6826e71 in nsXBLPrototypeBinding::BindingAttached (this=0x88450c8, 
aBoundElement=0x8856f58)
    at nsXBLPrototypeBinding.cpp:390
No locals.
#13 0xb68246fb in nsXBLBinding::ExecuteAttachedHandler (this=0x88443e0) at 
nsXBLBinding.cpp:768
No locals.
#14 0xb68d62c6 in nsElementSH::PostCreate (this=0x8457828, wrapper=0x8840758, 
cx=0x80d9730, obj=0x838ea08)
    at nsDOMClassInfo.cpp:5695
        rv = 0
        sc = {mRawPtr = 0x8824368}
        bindingURL = (class nsIURI *) 0x841a8e8
        content = {mRawPtr = 0x8856f58}
        shell = (class nsIPresShell *) 0x859ae80
        frame = (class nsIFrame *) 0x0
        dummy = 1
        xblService = {mRawPtr = 0x842fa10}
        binding = {mRawPtr = 0x88443e0}
        doc = {mRawPtr = 0x8433410}
        pctx = (class nsPresContext *) 0x83f9590
#15 0xb736a1bb in XPCWrappedNative::GetNewOrUsed (ccx=@0xbfffbbe0, 
Object=0x8856f74, Scope=0x82e3aa0, Interface=0x80d2a90, 
    resultWrapper=0xbfffbb6c) at xpcwrappednative.cpp:433
        si = (XPCNativeScriptableInfo *) 0x8668f60
        rv = 0
        newParentVal_automarker = {<AutoMarkingPtr> = {_vptr.AutoMarkingPtr = 
0xb738fc20, mNext = 0xbfffbae0, 
    mTLS = 0x80d19b8}, mPtr = 0xbfffba80}
        identity = {<nsCOMPtr_base> = {mRawPtr = 0x8856f58}, <No data fields>}
        mapLock = (XPCLock *) 0x80d1890
        wrapper = {<AutoMarkingPtr> = {_vptr.AutoMarkingPtr = 0xb73913e8, mNext 
= 0xbfffbb70, mTLS = 0x80d19b8}, 
  mPtr = 0x8840758}
        info = {mRawPtr = 0x845782c}
        sciWrapper = {mCallback = {mRawPtr = 0x8457828}, mFlags = {mFlags = 
191699533}}
        parent = (JSObject *) 0x838e9a8
---Type <return> to continue, or q <return> to quit---
        newParentVal_markable = {mVal = 0, mValPtr = 0xbfffba78}
        map = (Native2WrappedNativeMap *) 0x821c828
        isClassInfo = 0
        sciProto = {mCallback = {mRawPtr = 0x8457828}, mFlags = {mFlags = 
191699533}}
        newParentVal = 137947560
        proto = {<AutoMarkingPtr> = {_vptr.AutoMarkingPtr = 0xb738eea8, mNext = 
0xbfffba60, mTLS = 0x80d19b8}, 
  mPtr = 0x8668f40}
        wrapperToKill = (XPCWrappedNative *) 0x0
#16 0xb7348f32 in XPCConvert::NativeInterface2JSObject (ccx=@0xbfffbbe0, 
dest=0xbfffbcc0, src=0x8856f74, iid=0xb6a162f8, 
    scope=0x81c6960, pErr=0xbfffbbdc) at xpcconvert.cpp:1060
        xpcscope = (class XPCWrappedNativeScope *) 0x82e3aa0
        iface = {<AutoMarkingPtr> = {_vptr.AutoMarkingPtr = 0xb738eec0, mNext = 
0x0, mTLS = 0x80d19b8}, mPtr = 0x80d2a90}
        wrapper = (class XPCWrappedNative *) 0xb7336373
        rv = 3221207960
#17 0xb73306e2 in nsXPConnect::WrapNative (this=0x80d0268, aJSContext=0x80d9730, 
aScope=0x81c6960, aCOMObj=0x8856f74, 
    aIID=@0xb6a162f8, _retval=0xbfffbcc0) at nsXPConnect.cpp:566
        ccx = {<nsIXPCNativeCallContext> = {<nsISupports> = {_vptr.nsISupports = 
0xb738efa8}, <No data fields>}, mRefCnt = {
    mValue = 0}, _mOwningThread = {mThread = 0x8062330}, mState = 
XPCCallContext::HAVE_CONTEXT, mXPC = 0x80d0268, 
  mThreadData = 0x80d19b8, mXPCContext = 0x8230720, mJSContext = 0x80d9730, 
mContextPopRequired = 0, 
  mDestroyJSContextInDestructor = 0, mCallerLanguage = XPCContext::LANG_NATIVE, 
  mPrevCallerLanguage = XPCContext::LANG_UNKNOWN, mPrevCallContext = 0x0, 
mOperandJSObject = 0xbfffbd30, 
  mCurrentJSObject = 0xbfffbc28, mFlattenedJSObject = 0xb66e235c, mWrapper = 
0xb7d625f6, mTearOff = 0xb7fdf894, 
  mScriptableInfo = 0xbfffbc48, mSet = 0xb7f14cd3, mInterface = 0x0, mMember = 
0xb6aba9d0, mName = -1073759160, 
  mStaticMemberIsLocal = -1234296495, mArgc = 3221208256, mArgv = 0x0, mRetVal = 
0xbfffbc58, 
  mExceptionWasThrown = -1234298137, mReturnValueWasSet = -1073759040, 
mMethodIndex = 48320}
        rv = 2153185290
#18 0xb68c6d26 in nsDOMClassInfo::WrapNative (cx=0x80d9730, scope=0x81c6960, 
native=0x8856f74, aIID=@0xb6a162f8, 
    vp=0xbfffc454) at nsDOMClassInfo.cpp:1254
        holder = {mRawPtr = 0x0}
        rv = 3058408056
        obj = (JSObject *) 0xb7f14dda
#19 0xb68d6664 in nsArraySH::GetProperty (this=0x882c3e0, wrapper=0x88405e8, 
cx=0x80d9730, obj=0x838e9f8, id=5, 
    vp=0xbfffc454, _retval=0xbfffbda0) at nsDOMClassInfo.cpp:5775
        array_item = {<nsCOMPtr_base> = {mRawPtr = 0x8856f74}, <No data fields>}
        rv = 0
        is_number = 1
        n = 2
#20 0xb7376c75 in XPC_WN_Helper_GetProperty (cx=0x80d9730, obj=0x838e9f8, 
idval=5, vp=0xbfffc454)
    at xpcwrappednativejsops.cpp:811
        wrapper = (class XPCWrappedNative *) 0x88405e8
        retval = 1
        rv = 1
#21 0xb7e84dbf in js_GetProperty (cx=0x80d9730, obj=0x838e9f8, id=5, 
vp=0xbfffc454) at jsobj.c:2733
        default_val = -2147483647
        obj2 = (JSObject *) 0x0
        prop = (JSProperty *) 0x0
        scope = (JSScope *) 0x8668f80
---Type <return> to continue, or q <return> to quit---
        sprop = (JSScopeProperty *) 0x882ded0
        slot = 4294967295
#22 0xb7e6c7e6 in js_Interpret (cx=0x80d9730, pc=0x8840442 "7\002°
a\001c\004f\n", result=0xbfffc550) at jsinterp.c:3431
        rt = (JSRuntime *) 0x80c5da8
        fp = (JSStackFrame *) 0xbfffc530
        script = (JSScript *) 0x8840408
        inlineCallCount = 0
        obj = (JSObject *) 0x838e9f8
        obj2 = (JSObject *) 0x0
        proto = (JSObject *) 0x0
        parent = (JSObject *) 0x0
        currentVersion = JSVERSION_DEFAULT
        originalVersion = JSVERSION_DEFAULT
        onbranch = 0xb6892890 <nsJSContext::DOMBranchCallback(JSContext*, 
JSScript*)>
        ok = 1
        cond = -1220941106
        interruptHandler = 0
        depth = 2
        len = 1
        sp = (jsval *) 0x886bc30
        newsp = (jsval *) 0x886bc20
        mark = (void *) 0x80d9758
        endpc = (jsbytecode *) 0x8840444 "°a\001c\004f\n"
        pc2 = (jsbytecode *) 0x1 <Address 0x1 out of bounds>
        op = JSOP_GETELEM
        op2 = 3074101744
        cs = (const JSCodeSpec *) 0xb7ee7150
        atom = (JSAtom *) 0x811a340
        argc = 0
        slot = 7
        attrs = 135070192
        vp = (jsval *) 0x1
        lval = 137947640
        rval = -2147483647
        ltmp = 135070208
        rtmp = -1210711839
        id = 5
        withobj = (JSObject *) 0xbfffc6c0
        origobj = (JSObject *) 0x29
        propobj = (JSObject *) 0xb739e5ca
        iter_state = -1210699767
        prop = (JSProperty *) 0x80d01f0
        sprop = (JSScopeProperty *) 0x0
        str = (JSString *) 0xb7d67ff4
        str2 = (JSString *) 0xb7d630e2
        i = 2
        j = -1073756896
---Type <return> to continue, or q <return> to quit---
        d = -1.6957599667962077e-39
        d2 = 8.8526444653730626e-313
        clasp = (JSClass *) 0x8850420
        funclasp = (JSClass *) 0x1
        fun = (JSFunction *) 0xbfffc520
        type = 3221210400
        tracefp = (FILE *) 0x0
        ida = (JSIdArray *) 0xbfffc418
        low = -1209107680
        high = -1073756896
        off = 0
        npairs = -1073757160
        match = -7826616
        getter = 0xb7ee7b20 <PropertyTreeHashOps+384>
        setter = 0xb7e29f3d <FreeArenaList+12>
        foreach = 0
        stackDummy = 135108456
#23 0xb7e5e2d6 in js_Execute (cx=0x80d9730, chain=0x838df98, script=0x8840408, 
down=0x0, flags=0, result=0xbfffc63c)
    at jsinterp.c:1544
        hook = 0xb739e9e6 <jsd_TopLevelCallHook>
        hookData = (void *) 0x80c8af0
        mark = (void *) 0x0
        oldfp = (JSStackFrame *) 0x0
        frame = {callobj = 0x0, argsobj = 0x0, varobj = 0x838df98, script = 
0x8840408, fun = 0x0, thisp = 0x838df98, 
  argc = 0, argv = 0x0, rval = -2147483647, nvars = 0, vars = 0x0, down = 0x0, 
annotation = 0x0, scopeChain = 0x838df98, 
  pc = 0x8840442 "7\002°a\001c\004f\n", sp = 0x886bc40, spbase = 0x886bc28, 
sharpDepth = 0, sharpArray = 0x0, flags = 0, 
  dormantNext = 0x0, xmlNamespace = 0x0}
        obj = (JSObject *) 0x838df98
        tmp = (JSObject *) 0xbfffc530
        ok = -1073756880
#24 0xb7e288b2 in JS_EvaluateUCScriptForPrincipals (cx=0x80d9730, obj=0x838df98, 
principals=0x82176f4, chars=0x885f178, 
    length=41, filename=0xbfffc718 "chrome://global/content/bindings/tabbrowser.
xml", lineno=128, rval=0xbfffc63c)
    at jsapi.c:3739
        options = 8
        script = (JSScript *) 0x8840408
        ok = -1073756696
#25 0xb6894440 in nsJSContext::EvaluateStringWithValue (this=0x82428d8, 
aScript=@0xbfffc6c0, aScopeObject=0x838df98, 
    aPrincipal=0x0, aURL=0xbfffc718 "chrome://global/content/bindings/
tabbrowser.xml", aLineNo=128, aVersion=0x0, 
    aRetValue=0xbfffc6f8, aIsUndefined=0xbfffc6f4) at nsJSEnvironment.cpp:848
        oldVersion = JSVERSION_UNKNOWN
        newVersion = JSVERSION_UNKNOWN
        rv = 0
        jsprin = (JSPrincipals *) 0x82176f4
        ok = 1
        val = -1236937884
        principal = (nsIPrincipal *) 0x82176f0
        stack = {mRawPtr = 0x80d1940}
---Type <return> to continue, or q <return> to quit---
#26 0xb68340a1 in nsXBLProtoImplField::InstallMember (this=0x885f138, 
aContext=0x82428d8, aBoundElement=0x85db2b0, 
    aScriptObject=0x838df98, aTargetClassObject=0x838dfb8, aClassStr=@0x885ecb8) 
at nsXBLProtoImplField.cpp:126
        scriptObject = (JSObject *) 0x838df98
        hash = 47
        context = {mRawPtr = 0x82428d8}
        rv = 0
        cx = (JSContext *) 0x80d9730
        bindingURI = {<nsFixedCString> = {<nsCString> = {<nsCSubstring> = 
{<nsACString> = {mVTable = 0xb7fe54a8, 
          mData = 0xbfffc718 "chrome://global/content/bindings/tabbrowser.xml", 
mLength = 47, 
          mFlags = 65553}, <No data fields>}, <No data fields>}, mFixedCapacity 
= 63, 
    mFixedBuf = 0xbfffc718 "chrome://global/content/bindings/tabbrowser.xml"}, 
  mStorage = "chrome://global/content/bindings/tabbrowser.
xml\000hÇÿ¿Ø($\b8J\207\bÐÇÿ¿"}
        result = 0
        undefined = 0
#27 0xb6834384 in nsXBLProtoImpl::InstallImplementation (this=0x885ecb8, 
aBinding=0x8853b48, aBoundElement=0x85db2b0)
    at nsXBLProtoImpl.cpp:89
        curr = (class nsXBLProtoImplMember *) 0x885f138
        context = {mRawPtr = 0x82428d8}
        rv = 0
        document = (class nsIDocument *) 0x8433410
        global = (class nsIScriptGlobalObject *) 0x8226c48
        targetScriptObject = (void *) 0x838df98
        targetClassObject = (void *) 0x838dfb8
#28 0xb6826fa5 in nsXBLPrototypeBinding::InstallImplementation (this=0x8853b48, 
aBoundElement=0x85db2b0)
    at nsXBLPrototypeBinding.cpp:442
No locals.
#29 0xb6824593 in nsXBLBinding::InstallImplementation (this=0x8853eb0) at 
nsXBLBinding.cpp:733
No locals.
#30 0xb683d761 in nsXBLService::LoadBindings (this=0x842fa10, 
aContent=0x85db2b0, aURL=0x840e560, aAugmentFlag=0, 
    aBinding=0xbfffca70, aResolveStyle=0xbfffca68) at nsXBLService.cpp:629
        rv = 0
        bindingManager = (class nsIBindingManager *) 0x8433840
        binding = (nsXBLBinding *) 0x0
        docURI = (nsIURI *) 0x824fa20
        isChrome = 1
        ready = 1
        document = {mRawPtr = 0x8433410}
        newBinding = {mRawPtr = 0x8853eb0}
#31 0xb644e6f0 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db2b0, 
    aParentFrame=0x88241f4, aTag=0x8302d58, aNameSpaceID=9, 
aStyleContext=0x88242b0, aFrameItems=@0xbfffcd18, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7558
        rv = 142754480
        baseTag = {mRawPtr = 0x0}
        resolveStyle = 0
        xblService = (class nsIXBLService *) 0x842fa10
        nameSpaceID = 0
        styleContext = {mRawPtr = 0x88242b0}
---Type <return> to continue, or q <return> to quit---
        binding = {mBinding = {mRawPtr = 0x0}, mDocument = 0x8433410}
        adjParentFrame = (class nsIFrame *) 0x0
        pseudoParent = 0
        rv = 142754480
        display = (const nsStyleDisplay *) 0x882430c
        frameItems = (nsFrameItems *) 0x842fa10
        pseudoSaveState = {mItems = 0x0, mFirstLetterStyle = 0x85db1e0, 
mFirstLineStyle = 0xbfffca08, 
  mSavedItems = {<nsFrameItems> = {childList = 0xb7f9eb14, lastChild = 
0x85db1e0}, containingBlock = 0x0}, 
  mSavedFirstLetterStyle = 0, mSavedFirstLineStyle = 142754480, mChildListName = 
0x83f9590, mState = 0x85db2b0}
        lastChild = (class nsIFrame *) 0x8824198
#32 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db2b0, 
    aParentFrame=0x88241f4, aFrameItems=@0xbfffcd18) at nsCSSFrameConstructor.
cpp:7515
        rv = 0
        tag = (nsIAtom *) 0x8302d58
        styleContext = {mRawPtr = 0x88242b0}
        pageBreakAfter = 0
#33 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aFrame=0x88241f4, aCanHaveGeneratedContent=0, aFrameItems=@0xbfffcd18, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
        priorPseudoFrames = {mTableOuter = {mFrame = 0x0, mChildList = 
{childList = 0x0, lastChild = 0x0}, mChildList2 = {
      childList = 0x0, lastChild = 0x0}}, mTableInner = {mFrame = 0x0, 
mChildList = {childList = 0x0, lastChild = 0x0}, 
    mChildList2 = {childList = 0x0, lastChild = 0x0}}, mRowGroup = {mFrame = 
0x0, mChildList = {childList = 0x0, 
      lastChild = 0x0}, mChildList2 = {childList = 0x0, lastChild = 0x0}}, 
mColGroup = {mFrame = 0x0, mChildList = {
      childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 0x0, 
lastChild = 0x0}}, mRow = {mFrame = 0x0, 
    mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 
0x0, lastChild = 0x0}}, mCellOuter = {
    mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = 
{childList = 0x0, lastChild = 0x0}}, 
  mCellInner = {mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, 
mChildList2 = {childList = 0x0, 
      lastChild = 0x0}}, mLowestType = 0x0}
        iter = {mContent = {mRawPtr = 0x85db1e0}, mIndex = 0, mNodes = {mRawPtr 
= 0x0}}
        last = {mContent = {mRawPtr = 0x85db1e0}, mIndex = 1, mNodes = {mRawPtr 
= 0x0}}
        rv = 0
        styleContext = (nsStyleContext *) 0x8824198
#34 0xb644aeed in nsCSSFrameConstructor::ConstructXULFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aParentFrame=0x882412c, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x8824198, aFrameItems=@0xbfffd1d8, aXBLBaseTag=0, 
    aHasPseudoParent=0, aHaltProcessing=@0xbfffcea8) at nsCSSFrameConstructor.
cpp:6208
        childItems = {childList = 0x0, lastChild = 0x0}
        geometricParent = (class nsIFrame *) 0x882412c
        processAnonymousChildren = 0
        rv = 0
        frameHasBeenInitialized = 0
        value = {<nsFixedString> = {<nsString> = {<nsSubstring> = {<nsAString> = 
{mVTable = 0x8081378, mData = 0xb6aba9d0, 
          mLength = 3221212296, mFlags = 3059651070}, <No data fields>}, <No 
data fields>}, mFixedCapacity = 3221212568, 
    mFixedBuf = 0xbfffcd98}, mStorage = {52392, 49151, 58454, 46681, 52632, 
49151, 43472, 46763, 52392, 49151, 37374, 46686, 
    52576, 49151, 52576, 49151, 52424, 49151, 61545, 46684, 52632, 49151, 23324, 
46756, 136, 0, 37374, 46686, 52712, 49151, 
    43472, 46763, 52440, 49151, 7014, 46689, 52576, 49151, 43472, 46763, 52728, 
49151, 24081, 46688, 52576, 49151, 8, 0, 
    16792, 2178, 52496, 49151, 52576, 49151, 63636, 47101, 52504, 49151, 19578, 
47089, 4984, 2056, 36888, 2112}}
        primaryFrameSet = 0
---Type <return> to continue, or q <return> to quit---
        processChildren = 1
        isPopup = 0
        isReplaced = 1
        newFrame = (class nsIFrame *) 0x88241f4
        display = (const nsStyleDisplay *) 0x859b8b0
        isXULNS = 1
        topFrame = (class nsIFrame *) 0x88241f4
        origParentFrame = (class nsIFrame *) 0x882412c
        isXULDisplay = 1
#35 0xb644eb12 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aParentFrame=0x882412c, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x8824198, aFrameItems=@0xbfffd1d8, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7630
        haltProcessing = 0
        styleContext = {mRawPtr = 0x8824198}
        binding = {mBinding = {mRawPtr = 0x0}, mDocument = 0x8433410}
        adjParentFrame = (class nsIFrame *) 0x882412c
        pseudoParent = 0
        rv = 0
        display = (const nsStyleDisplay *) 0x859b8b0
        frameItems = (nsFrameItems *) 0xbfffd1d8
        pseudoSaveState = {mItems = 0x0, mFirstLetterStyle = 0x0, 
mFirstLineStyle = 0x0, mSavedItems = {<nsFrameItems> = {
      childList = 0x0, lastChild = 0x0}, containingBlock = 0x0}, 
mSavedFirstLetterStyle = 0, mSavedFirstLineStyle = 0, 
  mChildListName = 0x0, mState = 0x0}
        lastChild = (class nsIFrame *) 0x0
#36 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db1e0, 
    aParentFrame=0x882412c, aFrameItems=@0xbfffd1d8) at nsCSSFrameConstructor.
cpp:7515
        rv = 0
        tag = (nsIAtom *) 0x81335b8
        styleContext = {mRawPtr = 0x8824198}
        pageBreakAfter = 0
#37 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
    aFrame=0x882412c, aCanHaveGeneratedContent=0, aFrameItems=@0xbfffd1d8, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
        priorPseudoFrames = {mTableOuter = {mFrame = 0x0, mChildList = 
{childList = 0x0, lastChild = 0x0}, mChildList2 = {
      childList = 0x0, lastChild = 0x0}}, mTableInner = {mFrame = 0x0, 
mChildList = {childList = 0x0, lastChild = 0x0}, 
    mChildList2 = {childList = 0x0, lastChild = 0x0}}, mRowGroup = {mFrame = 
0x0, mChildList = {childList = 0x0, 
      lastChild = 0x0}, mChildList2 = {childList = 0x0, lastChild = 0x0}}, 
mColGroup = {mFrame = 0x0, mChildList = {
      childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 0x0, 
lastChild = 0x0}}, mRow = {mFrame = 0x0, 
    mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 
0x0, lastChild = 0x0}}, mCellOuter = {
    mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = 
{childList = 0x0, lastChild = 0x0}}, 
  mCellInner = {mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, 
mChildList2 = {childList = 0x0, 
      lastChild = 0x0}}, mLowestType = 0x0}
        iter = {mContent = {mRawPtr = 0x85db0f8}, mIndex = 0, mNodes = {mRawPtr 
= 0x0}}
        last = {mContent = {mRawPtr = 0x85db0f8}, mIndex = 1, mNodes = {mRawPtr 
= 0x0}}
        rv = 0
        styleContext = (nsStyleContext *) 0x8823fc0
#38 0xb644aeed in nsCSSFrameConstructor::ConstructXULFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
---Type <return> to continue, or q <return> to quit---
    aParentFrame=0x8823dcc, aTag=0x81335c0, aNameSpaceID=9, 
aStyleContext=0x8823fc0, aFrameItems=@0xbfffd698, aXBLBaseTag=0, 
    aHasPseudoParent=0, aHaltProcessing=@0xbfffd368) at nsCSSFrameConstructor.
cpp:6208
        childItems = {childList = 0x88241f4, lastChild = 0x88241f4}
        geometricParent = (class nsIFrame *) 0x8823dcc
        processAnonymousChildren = 0
        rv = 0
        frameHasBeenInitialized = 0
        value = {<nsFixedString> = {<nsString> = {<nsSubstring> = {<nsAString> = 
{mVTable = 0x8081378, mData = 0xb6aba9d0, 
          mLength = 3221213512, mFlags = 3059651070}, <No data fields>}, <No 
data fields>}, mFixedCapacity = 3221213784, 
    mFixedBuf = 0xbfffd258}, mStorage = {53608, 49151, 58454, 46681, 53848, 
49151, 43472, 46763, 53608, 49151, 37374, 46686, 
    53792, 49151, 53792, 49151, 53640, 49151, 61545, 46684, 53848, 49151, 23324, 
46756, 136, 0, 37374, 46686, 53928, 49151, 
    43472, 46763, 53656, 49151, 7014, 46689, 53792, 49151, 43472, 46763, 53944, 
49151, 24081, 46688, 53792, 49151, 8, 0, 
    16320, 2178, 53712, 49151, 53792, 49151, 63636, 47101, 53720, 49151, 19578, 
47089, 4984, 2056, 56992, 2111}}
        primaryFrameSet = 0
        processChildren = 1
        isPopup = 0
        isReplaced = 1
        newFrame = (class nsIFrame *) 0x882412c
        display = (const nsStyleDisplay *) 0x859b8b0
        isXULNS = 1
        topFrame = (class nsIFrame *) 0x882412c
        origParentFrame = (class nsIFrame *) 0x8823dcc
        isXULDisplay = 1
#39 0xb644eb12 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
    aParentFrame=0x8823dcc, aTag=0x81335c0, aNameSpaceID=9, 
aStyleContext=0x8823fc0, aFrameItems=@0xbfffd698, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7630
        haltProcessing = 0
        styleContext = {mRawPtr = 0x8823fc0}
        binding = {mBinding = {mRawPtr = 0x0}, mDocument = 0x8433410}
        adjParentFrame = (class nsIFrame *) 0x8823dcc
        pseudoParent = 0
        rv = 0
        display = (const nsStyleDisplay *) 0x859b8b0
        frameItems = (nsFrameItems *) 0xbfffd698
        pseudoSaveState = {mItems = 0x0, mFirstLetterStyle = 0x0, 
mFirstLineStyle = 0x0, mSavedItems = {<nsFrameItems> = {
      childList = 0x0, lastChild = 0x0}, containingBlock = 0x0}, 
mSavedFirstLetterStyle = 0, mSavedFirstLineStyle = 0, 
  mChildListName = 0x0, mState = 0x0}
        lastChild = (class nsIFrame *) 0x0
#40 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85db0f8, 
    aParentFrame=0x8823dcc, aFrameItems=@0xbfffd698) at nsCSSFrameConstructor.
cpp:7515
        rv = 0
        tag = (nsIAtom *) 0x81335c0
        styleContext = {mRawPtr = 0x8823fc0}
        pageBreakAfter = 0
#41 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aFrame=0x8823dcc, aCanHaveGeneratedContent=0, aFrameItems=@0xbfffd698, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
---Type <return> to continue, or q <return> to quit---
        priorPseudoFrames = {mTableOuter = {mFrame = 0x0, mChildList = 
{childList = 0x0, lastChild = 0x0}, mChildList2 = {
      childList = 0x0, lastChild = 0x0}}, mTableInner = {mFrame = 0x0, 
mChildList = {childList = 0x0, lastChild = 0x0}, 
    mChildList2 = {childList = 0x0, lastChild = 0x0}}, mRowGroup = {mFrame = 
0x0, mChildList = {childList = 0x0, 
      lastChild = 0x0}, mChildList2 = {childList = 0x0, lastChild = 0x0}}, 
mColGroup = {mFrame = 0x0, mChildList = {
      childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 0x0, 
lastChild = 0x0}}, mRow = {mFrame = 0x0, 
    mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 
0x0, lastChild = 0x0}}, mCellOuter = {
    mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = 
{childList = 0x0, lastChild = 0x0}}, 
  mCellInner = {mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, 
mChildList2 = {childList = 0x0, 
      lastChild = 0x0}}, mLowestType = 0x0}
        iter = {mContent = {mRawPtr = 0x85dad80}, mIndex = 2, mNodes = {mRawPtr 
= 0x0}}
        last = {mContent = {mRawPtr = 0x85dad80}, mIndex = 3, mNodes = {mRawPtr 
= 0x0}}
        rv = 0
        styleContext = (nsStyleContext *) 0x859bc24
#42 0xb644aeed in nsCSSFrameConstructor::ConstructXULFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aParentFrame=0x859bcdc, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x859bc24, aFrameItems=@0xbfffdab8, aXBLBaseTag=0, 
    aHasPseudoParent=0, aHaltProcessing=@0xbfffd828) at nsCSSFrameConstructor.
cpp:6208
        childItems = {childList = 0x882412c, lastChild = 0x882412c}
        geometricParent = (class nsIFrame *) 0x859bcdc
        processAnonymousChildren = 0
        rv = 0
        frameHasBeenInitialized = 0
        value = {<nsFixedString> = {<nsString> = {<nsSubstring> = {<nsAString> = 
{mVTable = 0x840901c, mData = 0x4, 
          mLength = 3064220642, mFlags = 3086609172}, <No data fields>}, <No 
data fields>}, mFixedCapacity = 3064703440, 
    mFixedBuf = 0xbfffdb5c}, mStorage = {54808, 49151, 41387, 46685, 36888, 
2112, 1, 0, 36908, 2112, 36888, 2112, 0, 0, 
    21044, 46756, 54856, 49151, 61842, 47097, 9718, 47062, 63636, 47101, 54872, 
49151, 59644, 47097, 4984, 2056, 36888, 
    2112, 3, 0, 19426, 46756, 9008, 2054, 43472, 46763, 54920, 49151, 7476, 
46684, 36892, 2112, 3, 0, 19426, 46756, 54932, 
    49151, 9718, 47062, 63636, 47101, 54936, 49151, 19578, 47089, 4984, 2056, 
36888, 2112}}
        primaryFrameSet = 0
        processChildren = 1
        isPopup = 0
        isReplaced = 1
        newFrame = (class nsIFrame *) 0x8823dcc
        display = (const nsStyleDisplay *) 0x859b8b0
        isXULNS = 1
        topFrame = (class nsIFrame *) 0x8823dcc
        origParentFrame = (class nsIFrame *) 0x859bcdc
        isXULDisplay = 1
#43 0xb644eb12 in nsCSSFrameConstructor::ConstructFrameInternal (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aParentFrame=0x859bcdc, aTag=0x81335b8, aNameSpaceID=9, 
aStyleContext=0x859bc24, aFrameItems=@0xbfffdab8, aXBLBaseTag=0)
    at nsCSSFrameConstructor.cpp:7630
        haltProcessing = 0
        styleContext = {mRawPtr = 0x859bc24}
        binding = {mBinding = {mRawPtr = 0x0}, mDocument = 0x8433410}
        adjParentFrame = (class nsIFrame *) 0x859bcdc
        pseudoParent = 0
        rv = 0
        display = (const nsStyleDisplay *) 0x859b8b0
---Type <return> to continue, or q <return> to quit---
        frameItems = (nsFrameItems *) 0xbfffdab8
        pseudoSaveState = {mItems = 0x0, mFirstLetterStyle = 0x0, 
mFirstLineStyle = 0x0, mSavedItems = {<nsFrameItems> = {
      childList = 0x0, lastChild = 0x0}, containingBlock = 0x0}, 
mSavedFirstLetterStyle = 0, mSavedFirstLineStyle = 0, 
  mChildListName = 0x0, mState = 0x0}
        lastChild = (class nsIFrame *) 0x8745194
#44 0xb644e59f in nsCSSFrameConstructor::ConstructFrame (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x85dad80, 
    aParentFrame=0x859bcdc, aFrameItems=@0xbfffdab8) at nsCSSFrameConstructor.
cpp:7515
        rv = 0
        tag = (nsIAtom *) 0x81335b8
        styleContext = {mRawPtr = 0x859bc24}
        pageBreakAfter = 0
#45 0xb6458aaf in nsCSSFrameConstructor::ProcessChildren (this=0x83fa220, 
aState=@0xbfffdc60, aContent=0x829c5a0, 
    aFrame=0x859bcdc, aCanHaveGeneratedContent=1, aFrameItems=@0xbfffdab8, 
aParentIsBlock=0, aTableCreator=0x0)
    at nsCSSFrameConstructor.cpp:11763
        priorPseudoFrames = {mTableOuter = {mFrame = 0x0, mChildList = 
{childList = 0x0, lastChild = 0x0}, mChildList2 = {
      childList = 0x0, lastChild = 0x0}}, mTableInner = {mFrame = 0x0, 
mChildList = {childList = 0x0, lastChild = 0x0}, 
    mChildList2 = {childList = 0x0, lastChild = 0x0}}, mRowGroup = {mFrame = 
0x0, mChildList = {childList = 0x0, 
      lastChild = 0x0}, mChildList2 = {childList = 0x0, lastChild = 0x0}}, 
mColGroup = {mFrame = 0x0, mChildList = {
      childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 0x0, 
lastChild = 0x0}}, mRow = {mFrame = 0x0, 
    mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 
0x0, lastChild = 0x0}}, mCellOuter = {
    mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = 
{childList = 0x0, lastChild = 0x0}}, 
  mCellInner = {mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, 
mChildList2 = {childList = 0x0, 
      lastChild = 0x0}}, mLowestType = 0x0}
        iter = {mContent = {mRawPtr = 0x829c5a0}, mIndex = 32, mNodes = {mRawPtr 
= 0x0}}
        last = {mContent = {mRawPtr = 0x829c5a0}, mIndex = 79, mNodes = {mRawPtr 
= 0x0}}
        rv = 0
        styleContext = (nsStyleContext *) 0x859bb6c
#46 0xb6446aa2 in nsCSSFrameConstructor::ConstructDocElementFrame 
(this=0x83fa220, aState=@0xbfffdc60, 
    aDocElement=0x829c5a0, aParentFrame=0x859ba98, aNewFrame=0xbfffdd44) at 
nsCSSFrameConstructor.cpp:4415
        absoluteSaveState = {mItems = 0x0, mFirstLetterStyle = 0x0, 
mFirstLineStyle = 0x0, mSavedItems = {<nsFrameItems> = {
      childList = 0x0, lastChild = 0x0}, containingBlock = 0x0}, 
mSavedFirstLetterStyle = 0, mSavedFirstLineStyle = 0, 
  mChildListName = 0x0, mState = 0x0}
        floatSaveState = {mItems = 0x0, mFirstLetterStyle = 0x0, mFirstLineStyle 
= 0x0, mSavedItems = {<nsFrameItems> = {
      childList = 0x0, lastChild = 0x0}, containingBlock = 0x0}, 
mSavedFirstLetterStyle = 0, mSavedFirstLineStyle = 0, 
  mChildListName = 0x0, mState = 0x0}
        childItems = {childList = 0x859bd80, lastChild = 0x8823dcc}
        styleContext = {mRawPtr = 0x859bb6c}
        contentFrame = (class nsIFrame *) 0x859bcdc
        isBlockFrame = 0
        rv = 0
        display = (const nsStyleDisplay *) 0x859bb98
        propagatedScrollToViewport = 1
        isScrollable = 0
        scrollFrame = (class nsIFrame *) 0x0
        docElemIsTable = 0
#47 0xb6452597 in nsCSSFrameConstructor::ContentInserted (this=0x83fa220, 
aContainer=0x0, aContainerFrame=0x0, 
    aChild=0x829c5a0, aIndexInContainer=0, aFrameState=0x0, 
aInReinsertContent=0) at nsCSSFrameConstructor.cpp:9025
---Type <return> to continue, or q <return> to quit---
        docElementFrame = (class nsIFrame *) 0x859bcdc
        state = {mPresContext = 0x83f9590, mPresShell = 0x859ae80, mFrameManager 
= 0x859ae9c, 
  mFixedItems = {<nsFrameItems> = {childList = 0x0, lastChild = 0x0}, 
containingBlock = 0x859b9b4}, 
  mAbsoluteItems = {<nsFrameItems> = {childList = 0x0, lastChild = 0x0}, 
containingBlock = 0x0}, 
  mFloatedItems = {<nsFrameItems> = {childList = 0x0, lastChild = 0x0}, 
containingBlock = 0x0}, mFirstLetterStyle = 0, 
  mFirstLineStyle = 0, mFrameState = {mRawPtr = 0x0}, mPseudoFrames = 
{mTableOuter = {mFrame = 0x0, mChildList = {
        childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 0x0, 
lastChild = 0x0}}, mTableInner = {mFrame = 0x0, 
      mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = {childList 
= 0x0, lastChild = 0x0}}, mRowGroup = {
      mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 
= {childList = 0x0, lastChild = 0x0}}, 
    mColGroup = {mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, 
mChildList2 = {childList = 0x0, 
        lastChild = 0x0}}, mRow = {mFrame = 0x0, mChildList = {childList = 0x0, 
lastChild = 0x0}, mChildList2 = {
        childList = 0x0, lastChild = 0x0}}, mCellOuter = {mFrame = 0x0, 
mChildList = {childList = 0x0, lastChild = 0x0}, 
      mChildList2 = {childList = 0x0, lastChild = 0x0}}, mCellInner = {mFrame = 
0x0, mChildList = {childList = 0x0, 
        lastChild = 0x0}, mChildList2 = {childList = 0x0, lastChild = 0x0}}, 
mLowestType = 0x0}, mAnonymousCreator = 0x0, 
  mInsertionContent = 0x0, mCreatorIsBlock = 0}
        docElement = (class nsIContent *) 0x829c5a0
        rv = 0
        container = (class nsIContent *) 0x829c5a0
        isAppend = 0
        handleSpecialFrame = 0
        state = {mPresContext = 0x83f9590, mPresShell = 0x859ae80, mFrameManager 
= 0x859ae9c, 
  mFixedItems = {<nsFrameItems> = {childList = 0x0, lastChild = 0x0}, 
containingBlock = 0x859b9b4}, 
  mAbsoluteItems = {<nsFrameItems> = {childList = 0x0, lastChild = 0x0}, 
containingBlock = 0x0}, 
  mFloatedItems = {<nsFrameItems> = {childList = 0x0, lastChild = 0x0}, 
containingBlock = 0x0}, mFirstLetterStyle = 0, 
  mFirstLineStyle = 0, mFrameState = {mRawPtr = 0x0}, mPseudoFrames = 
{mTableOuter = {mFrame = 0x0, mChildList = {
        childList = 0x0, lastChild = 0x0}, mChildList2 = {childList = 0x0, 
lastChild = 0x0}}, mTableInner = {mFrame = 0x0, 
      mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 = {childList 
= 0x0, lastChild = 0x0}}, mRowGroup = {
      mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, mChildList2 
= {childList = 0x0, lastChild = 0x0}}, 
    mColGroup = {mFrame = 0x0, mChildList = {childList = 0x0, lastChild = 0x0}, 
mChildList2 = {childList = 0x0, 
        lastChild = 0x0}}, mRow = {mFrame = 0x0, mChildList = {childList = 0x0, 
lastChild = 0x0}, mChildList2 = {
        childList = 0x0, lastChild = 0x0}}, mCellOuter = {mFrame = 0x0, 
mChildList = {childList = 0x0, lastChild = 0x0}, 
      mChildList2 = {childList = 0x0, lastChild = 0x0}}, mCellInner = {mFrame = 
0x0, mChildList = {childList = 0x0, 
        lastChild = 0x0}, mChildList2 = {childList = 0x0, lastChild = 0x0}}, 
mLowestType = 0x0}, mAnonymousCreator = 0x0, 
  mInsertionContent = 0x0, mCreatorIsBlock = 0}
        blockSC = (nsStyleContext *) 0x0
        blockContent = (class nsIContent *) 0x0
        selectContent = {mRawPtr = 0x0}
        insertionPoint = (class nsIFrame *) 0x859bcdc
        haveFirstLineStyle = 0
        newFrame = (class nsIFrame *) 0x859ae80
        parentFrame = (class nsIFrame *) 0x0
        prevSibling = (class nsIFrame *) 0x0
        nextSibling = (class nsIFrame *) 0x0
        containingBlock = (class nsIFrame *) 0x0
        frameItems = {childList = 0x0, lastChild = 0x0}
        haveFirstLetterStyle = 0
        parentDisplay = (const nsStyleDisplay *) 0x0
---Type <return> to continue, or q <return> to quit---
        selectElement = {mRawPtr = 0x8081378}
#48 0xb64a1bbf in PresShell::InitialReflow (this=0x859ae80, aWidth=17, 
aHeight=17) at nsPresShell.cpp:2803
        root = (class nsIContent *) 0x829c5a0
        rootFrame = (class nsIFrame *) 0x859b9b4
#49 0xb6866311 in nsXULDocument::StartLayout (this=0x8433410) at nsXULDocument.
cpp:2151
        container = {<nsCOMPtr_base> = {mRawPtr = 0x8249af4}, <No data fields>}
        docShell = {mRawPtr = 0x8249b84}
        shell = (class nsIPresShell *) 0x859ae80
        cx = (class nsPresContext *) 0x83f9590
        r = {x = 0, y = 0, width = 17, height = 17}
        vm = (class nsIViewManager *) 0x83f9bc0
        i = 0
        count = 1
#50 0xb6869fce in nsXULDocument::ResumeWalk (this=0x8433410) at nsXULDocument.
cpp:3176
        title = {<nsFixedString> = {<nsString> = {<nsSubstring> = {<nsAString> = 
{mVTable = 0xb7fe5528, mData = 0x83034a0, 
          mLength = 30, mFlags = 65541}, <No data fields>}, <No data fields>}, 
mFixedCapacity = 63, mFixedBuf = 0xbfffe058}, 
  mStorage = {0, 0, 2, 0, 2, 0, 2268, 46870, 55624, 2118, 39424, 46954, 40, 0, 
39424, 46954, 57544, 49151, 48113, 46953, 
    39500, 46954, 2268, 46870, 57512, 49151, 12942, 46853, 39664, 2084, 57536, 
49151, 42012, 47062, 60180, 47097, 57568, 
    49151, 2268, 46870, 57688, 49151, 60180, 47097, 57568, 49151, 64944, 2084, 
0, 0, 4, 0, 3, 0, 13026, 47062, 32756, 47062, 
    61842, 47097, 9718, 47062, 63636, 47101}}
        rv = 0
        secMan = {mRawPtr = 0x81dcc18}
        didInitialReflow = 0
        shell = (class nsIPresShell *) 0x859ae80
#51 0xb686f65d in nsXULDocument::CachedChromeStreamListener::OnStopRequest 
(this=0x857b140, request=0x82feb08, aContext=0x0, 
    aStatus=0) at nsXULDocument.cpp:4377
        rv = 0
#52 0xb6d012b8 in nsDocumentOpenInfo::OnStopRequest (this=0x8302248, 
request=0x82feb08, aCtxt=0x0, aStatus=0)
    at nsURILoader.cpp:366
        listener = {mRawPtr = 0x857b140}
#53 0xb611cb08 in nsCachedChromeChannel::HandleStopLoadEvent (aEvent=0x859c948) 
at nsChromeProtocolHandler.cpp:476
        event = (nsCachedChromeChannel::LoadEvent *) 0x859c948
        channel = (nsCachedChromeChannel *) 0x82feb08
        request = (nsIRequest *) 0x82feb08
#54 0xb7f87019 in PL_HandleEvent (self=0x859c948) at plevent.c:698
        result = (void *) 0x859c948
#55 0xb7f86ece in PL_ProcessPendingEvents (self=0x81e7918) at plevent.c:633
        event = (PLEvent *) 0x859c948
        count = 0
#56 0xb7f8a208 in nsEventQueueImpl::ProcessPendingEvents (this=0x81e78e0) at 
nsEventQueue.cpp:418
        correctThread = 1
#57 0xb4da5fb4 in event_processor_callback (source=0x83026a8, condition=G_IO_IN, 
data=0x81e78e0) at nsAppShell.cpp:67
        eventQueue = (class nsIEventQueue *) 0x81e78e0
#58 0xb78d90f1 in g_vasprintf () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#59 0x083026a8 in ?? ()
No symbol table info available.
---Type <return> to continue, or q <return> to quit---
#60 0x00000001 in ?? ()
No symbol table info available.
#61 0x081e78e0 in ?? ()
No symbol table info available.
#62 0xb7d600f9 in pthread_mutex_unlock () from /lib/libpthread.so.0
No symbol table info available.
#63 0xb78a1a7a in g_source_remove_poll () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#64 0x08301890 in ?? ()
No symbol table info available.
#65 0xb4da5f90 in nsBaseWidget::FreeNativeData () at nsISupportsImpl.h:60
        debug_NumPrefValues = 6
        kUseAltDCFor_SURFACE_DIM = 8 '\b'
        kPrefCID = {m0 = 3693535456, m1 = 51860, m2 = 4561, m3 = 
"©¤\000\200_\212zÄ"}
        kUseAltDCFor_CREATERC_REFLOW = 2 '\002'
        kUseAltDCFor_FONTMETRICS = 1 '\001'
        kUseAltDCFor_CREATERC_PAINT = 4 '\004'
        debug_PrefValues = {{name = 0xb4dce6b0 "nglayout.debug.
crossing_event_dumping", value = 0}, {
    name = 0xb4dce6d6 "nglayout.debug.event_dumping", value = 0}, {name = 
0xb4dce6f4 "nglayout.debug.invalidate_dumping", 
    value = 0}, {name = 0xb4dce718 "nglayout.debug.motion_event_dumping", value 
= 0}, {
    name = 0xb4dce73c "nglayout.debug.paint_dumping", value = 0}, {name = 
0xb4dce759 "nglayout.debug.paint_flashing", 
    value = 0}}
        kUseAltDCFor_NONE = 0 '\0'
        *_ZZN16nsIScreenManager6GetIIDEvE3iid = {m0 = 1714322296, m1 = 7634, m2 
= 4530, m3 = "£Óü\036__¹Ô"}
        *_ZZN13nsIProperties6GetIIDEvE3iid = {m0 = 2019886466, m1 = 20115, m2 = 
19296, m3 = "\216\205&ëÓë\024Ê"}
        *_ZZN7nsIPref6GetIIDEvE3iid = {m0 = 2720716720, m1 = 51846, m2 = 4561, 
m3 = "©¤\000\200_\212zÄ"}
        *_ZZN13nsCOMTypeInfoI11nsISupportsE6GetIIDEvE20iid_NS_ISUPPORTS_IID = 
{m0 = 0, m1 = 0, m2 = 0, 
  m3 = "À\000\000\000\000\000\000F"}
        *_ZZN9nsIScreen6GetIIDEvE3iid = {m0 = 4146627342, m1 = 7633, m2 = 4530, 
m3 = "\225\230û\237AO$e"}
        *_ZZN13nsIFullScreen6GetIIDEvE3iid = {m0 = 2555680622, m1 = 7633, m2 = 
4530, m3 = "\203PæÓP\231ûÎ"}
        *_ZZN19nsIRenderingContext6GetIIDEvE3iid = {m0 = 3642716811, m1 = 55284, 
m2 = 19993, m3 = "\213Ý\230\231?ßìÆ"}
        *_ZZN11nsIAppShell6GetIIDEvE3iid = {m0 = 2692054065, m1 = 61100, m2 = 
4561, m3 = "\236Á\000ª\000/¸!"}
        *_ZZN9nsIWidget6GetIIDEvE3iid = {m0 = 402860757, m1 = 45669, m2 = 4561, 
m3 = "ª*\000\000\000\000\000"}
        *_ZZN19nsISimpleEnumerator6GetIIDEvE3iid = {m0 = 3515454016, m1 = 63954, 
m2 = 4562, m3 = "½Ö\000\000dest"}
        *_ZZN16nsIDeviceContext6GetIIDEvE3iid = {m0 = 1496434048, m1 = 47383, m2 
= 4561, m3 = "¨$\000@\225\232(É"}
        *_ZZN12nsILocalFile6GetIIDEvE3iid = {m0 = 2858487584, m1 = 43145, m2 = 
4563, m3 = "\214\201\000\000dest"}
(gdb) 

Comment 3

[Daniel Veditz [:dveditz]]

Johnny, Brendan: Assertion regression from bug 289074. I don't see any such
assertion in nsScriptSecurityManager code, though. I do see something like it in
jsinterp.c, but that's not the given line number and doesn't look like in-lined
code. Maybe I missed a macro.

Comment 4

[timeless]

see bug 289074 comment 30 and bug 289074 comment 31

*** This bug has been marked as a duplicate of 289074 ***

Comment 5

[timeless]

the see note is to dveditz, as the reporter can't see.

reporter: the code was changed because people hit it. cvs update.