294236 - Going back two sites crashes (fastback enabled) [@ nsDocShell::RestorePresentation]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Frank Wein [:mcsmurf]]

To reproduce:
(0. Set pref browser.sessionhistory.max_viewers to some value, here 5).
1. Go to URL
2. Click any "Download (HTTP)" link on that page (scroll down a bit)
3. Extend list on the back button with the small triangle and select the last
entry (that's the original URL).
4. Observe Crash

Stacktrace:
nsDocShell::RestorePresentation(nsDocShell * const 0x03683c50, nsISHEntry *
0x02e7fd18, int 0x03c30544, int * 0x0012f524) line 5184 + 8 bytes
nsDocShell::InternalLoad(nsDocShell * const 0x00000000, nsIURI * 0x025208e8,
nsIURI * 0x02e5ea58, nsISupports * 0x00000000, unsigned int 0x00000000, const
unsigned short * 0x00000000, const char * 0x039b3c18, nsIInputStream *
0x00000000, nsIInputStream * 0x00000000, unsigned int 0x00000000, nsISHEntry *
0x02e7fd18, int 0x00000001, nsIDocShell * * 0x00000000, nsIRequest * * ...) lin
nsDocShell::LoadHistoryEntry(nsDocShell * const 0x04dc52e8, nsISHEntry *
0x02e7fd18, unsigned int 0x00000004) line 7195
nsDocShell::LoadURI(nsDocShell * const 0x038e8c7c, nsIURI * 0x04f27958,
nsIDocShellLoadInfo * 0x038e8c78, unsigned int 0x00000004, int 0x00000000) line 729
nsFrameLoader::LoadFrame(nsFrameLoader * const 0x050dc468) line 172
nsGenericHTMLFrameElement::LoadSrc(nsGenericHTMLFrameElement * const 0x03683c50)
line 3464 + 6 bytes
nsGenericHTMLFrameElement::BindToTree(nsGenericHTMLFrameElement * const
0x03683c50, nsIDocument * 0x051bcf20, nsIContent * 0x056d76f0, nsIContent *
0x00000000, int 0x00000001) line 3490
nsGenericElement::AppendChildTo(nsGenericElement * const 0x03683c50, nsIContent
* 0x054f2090, int 0x00000000) line 2761
SinkContext::AddLeaf(SinkContext * const 0x03683c50, nsGenericHTMLElement *
0x054f2090) line 1536
SinkContext::AddLeaf(SinkContext * const 0x03683c50, const nsIParserNode &
{...}) line 1468
HTMLContentSink::AddLeaf(HTMLContentSink * const 0x039ad65c, const nsIParserNode
& {...}) line 3059
CNavDTD::AddLeaf(CNavDTD * const 0x03683c50, const nsIParserNode * 0x0311e720)
line 3647 + 13 bytes
CNavDTD::HandleDefaultStartToken(CNavDTD * const 0x03683c50, CToken *
0x03915e68, nsHTMLTag eHTMLTag_a, nsCParserNode * 0x0311e720) line 1335 + 8 bytes
CNavDTD::HandleStartToken(CNavDTD * const 0x03683c50, CToken * 0x0311e720) line
1711 + 14 bytes
CNavDTD::HandleToken(CNavDTD * const 0x02e9a660, CToken * 0x01b784c8, nsIParser
* 0x03ea1940) line 954 + 8 bytes
CNavDTD::BuildModel(CNavDTD * const 0x02e9a660, nsIParser * 0x03ea1940,
nsITokenizer * 0x02f12d50, nsITokenObserver * 0x00000000, nsIContentSink *
0x039ad65c) line 461 + 10 bytes
nsParser::BuildModel(nsParser * const 0x02f12d50) line 2080
nsParser::ResumeParse(nsParser * const 0x03683c50, int 0x01b6176d, int
0x00000001, int 0x00000001) line 1942 + 6 bytes
nsParser::ContinueInterruptedParsing(nsParser * const 0x02ebf949) line 1451 + 12
bytes
GKLAYOUT! const  nsXULElement::`vftable'{for `nsGenericElement'} address 0x0168a968

It seems the anti-frame JS code here causes this problem:
<SCRIPT language="JavaScript">
  <!--
  if (window != top)
    top.location.href = location.href;
  // -->
</SCRIPT>

The site "Download (HTTP)" links to immediately reloads itself to get rid of the
frame on the left, Mozilla seems to get confused about this.

Comment 1

[Frank Wein [:mcsmurf]]

Good news, already fixed some hours ago by Bug 293534.