303504 - Crash when clicking "Read more..." link in "Expert Advice" sidebar [@ nsHTMLDocument::SetDomain ]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jeff Walden [:Waldo]]

To reproduce:
1. Visit the URL in the bug info.
2. Click on the link "Read more..." in the "Expert Advice" sidebar.
3. A popup appears.
4. Crash!  No Talkback is displayed, and all that happens is a generic Windows
dialog about how 'the memory could not be "read" at 0x0'.

I'm using the 20050804 Firefox nightly build, which was originally a 20050803
build updated using built-in update stuff with the nightly update track on
aus-staging.m.o:8711.

A few option values which might or might not be useful (mostly guesses based on
it being a popup window):

browser.link.open_newwindow:               3
browser.link.open_newwindow.restriction:   2

Without having Talkback run I have no idea where the crash is, so someone
running a debug build or something needs to check this out and move the bug to a
real component, because this *clearly* isn't the right one.  :-)

Comment 1

[Ria Klaassen (not reading all bugmail)]

Yep, I get some talkbacks:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB8106516G
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB8106598Z

Comment 2

[Jaime Mitchell (use [e-mail] for email)]

Incident ID: 8106516
Stack Signature	nsHTMLDocument::SetDomain fc9f2390
Product ID	FirefoxTrunk
Build ID	2005080406
Trigger Time	2005-08-05 05:14:34.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	firefox.exe + (001aa205)
URL visited	http://www.rei.com/category/4500791.htm
User Comments	
Since Last Crash	40173 sec
Total Uptime	40173 sec
Trigger Reason	Access violation
Source File, Line No.
c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1520
Stack Trace 	
nsHTMLDocument::SetDomain 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/html/document/src/nsHTMLDocument.cpp,
line 1520]
nsContentList::GetLength 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentList.cpp,
line 491]
nsContentList::ContentAppended 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsContentList.cpp,
line 578]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2068]
XPC_WN_GetterSetter 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1418]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1173]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1270]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_GetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsobj.c, line 2843]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 3290]
js_Execute 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsinterp.c, line 1404]
JS_EvaluateUCScriptForPrincipals 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/js/src/jsapi.c, line 3854]
nsJSContext::EvaluateStringWithValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 813]
nsScriptLoader::ProcessScriptElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 427]
nsScriptLoader::IsScriptEventHandler 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 328]
nsScriptLoader::ProcessScriptElement 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/content/base/src/nsScriptLoader.cpp,
line 597]
nsStreamLoader::nsStreamLoader 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsStreamLoader.h,
line 55]
nsDirIndex::SetType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/streamconv/converters/nsDirIndex.cpp,
line 54]
nsInputStreamPump::OnInputStreamReady 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp,
line 340]

TB8106598Z is the same

Comment 3

[Adam Guthrie]

Jeff, can you still reproduce this? I tried on today's trunk in Windows and
didn't get a crash.

Comment 4

[Jeff Walden [:Waldo]]

(In reply to comment #3)
> Jeff, can you still reproduce this? I tried on today's trunk in Windows and
> didn't get a crash.

Nope, not getting a crash in Windows or Linux, trunk or branch.  Marking WFM...