32392 - Crash when going to theonion.com from history

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Richard Zach]

Whenever I go to http://theonion.com from the history, I segfault.

To reproduce:

1. Go to http://theonion.com/
2. Go to another page (doesn't matter whether by typing in URL bar, clicking on
link, or clicking on bookmark).
3. Hit back or go to the page from the Go menu.

Actual result: segfault
Expected result: dispalys theonion.com again

Doesn' happen when I simply reload the page

Linux build 2000.03.18.08

Stack:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 848]

Program received signal SIGSEGV, Segmentation fault.
0x40f654f5 in NSGetModule ()
(gdb) where
#0  0x40f654f5 in NSGetModule ()
#1  0x40f65b10 in NSGetModule ()
#2  0x40f66583 in NSGetModule ()
#3  0x4019283c in nsWebShell::LoadURL ()
#4  0x401903a8 in nsWebShell::LoadURL ()
#5  0x40191443 in nsWebShell::LoadURI ()
#6  0x40bf755b in NSGetModule ()
#7  0x40b40bcf in NSGetModule ()
#8  0x40bf5d94 in NSGetModule ()
#9  0x40b40bcf in NSGetModule ()
#10 0x40bf954c in NSGetModule ()
#11 0x40bfa395 in NSGetModule ()
#12 0x40b3e2e7 in NSGetModule ()
#13 0x40b3a05c in NSGetModule ()
#14 0x40b39193 in NSGetModule ()
#15 0x40b38dd8 in NSGetModule ()
#16 0x40b37c00 in NSGetModule ()
#17 0x40b357da in NSGetModule ()
#18 0x40b40bcf in NSGetModule ()
#19 0x40b4d179 in NSGetModule ()
#20 0x40b40bcf in NSGetModule ()
#21 0x40b6ee14 in NSGetModule ()
#22 0x40b604bb in NSGetModule ()
#23 0x40be9172 in NSGetModule ()
#24 0x40be8d46 in NSGetModule ()
#25 0x40911b23 in NSGetModule ()
#26 0x4091204a in NSGetModule ()
#27 0x40912118 in NSGetModule ()
#28 0x40912309 in NSGetModule ()
#29 0x40910725 in NSGetModule ()
#30 0x4090f14d in NSGetModule ()
#31 0x4090ebf5 in NSGetModule ()
#32 0x4091e950 in NSGetModule ()
#33 0x4091e7b5 in NSGetModule ()
#34 0x4091efc2 in NSGetModule ()
#35 0x4073f487 in NSGetModule ()
#36 0x4067a193 in NSGetModule ()
#37 0x406f9d9f in NSGetModule ()
#38 0x406b0d60 in NSGetModule ()
#39 0x406b06c0 in NSGetModule ()
#40 0x401018cb in PL_HandleEvent ()
#41 0x40101806 in PL_ProcessPendingEvents ()
#42 0x401024c8 in nsEventQueueImpl::ProcessPendingEvents ()
#43 0x412ff4ef in nsAppShell::SetDispatchListener ()
#44 0x412ff2bd in keysym2ucs ()
#45 0x405a252a in g_io_unix_dispatch ()
#46 0x405a3be6 in g_main_dispatch ()
#47 0x405a41a1 in g_main_iterate ()
#48 0x405a4341 in g_main_run ()
#49 0x404c9859 in gtk_main ()
#50 0x412ff9aa in nsAppShell::Run ()
#51 0x40f5acf2 in NSGetModule ()
#52 0x804af9c in JS_PushArguments ()
#53 0x804b2bc in JS_PushArguments ()
#54 0x402eccb3 in __libc_start_main (main=0x804b130 <JS_PushArguments+7344>, 
    argc=1, argv=0xbffff834, init=0x8049190 <_init>, fini=0x804c0a0 <_fini>, 
    rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffff82c)
    at ../sysdeps/generic/libc-start.c:78

Comment 1

[Richard Zach]

Note: I'm waiting for the page to load, so this isn't (as far as I can tell) a
dup of bug 31834.

Comment 2

[Cyril Bortolato]

This could be related to bug #31870, although I did not see any IFRAME
in theonion's webpage.

Comment 3

[don]

Hmmmm, I can't reproduce this on Windows with the beta 1 candidate.  Doesn't
appear to be a frame page either ...

Comment 4

[Radha on family leave (not reading bugmail)]

I see a crash but in a slightly different situation.
1) Go to www.theonion.com.
2) Click on any link in that page or any link from the personal toolbar or type 
in to the urlbar.
3) You crash when the page is loading 'coz mDocShell is null in the following 
stack trace.

nsDSWebProgressListener::OnStatusChange(nsDSWebProgressListener * const 
0x02af1c20, nsIChannel * 0x00000000, int 0) line 93 + 20 bytes
nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x02aa4210, nsIChannel 
* 0x02af00c0, unsigned int 0) line 623
nsDocLoaderImpl::DocLoaderIsEmpty(unsigned int 0) line 514
nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x02aa4214, nsIChannel * 
0x02d9d500, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 
0x00000000) line 458
nsLoadGroup::RemoveChannel(nsLoadGroup * const 0x02aa41b0, nsIChannel * 
0x02d9d500, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 
0x00000000) line 543 + 39 bytes
nsHTTPChannel::ResponseCompleted(nsIStreamListener * 0x02d9c690, unsigned int 0, 
const unsigned short * 0x00000000) line 1502
nsHTTPServerListener::OnStopRequest(nsHTTPServerListener * const 0x02da98a0, 
nsIChannel * 0x031975f4, nsISupports * 0x02d9d500, unsigned int 0, const 
unsigned short * 0x00000000) line 538
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x02db5c30) line 
286
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02db38e0) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x02db38e0) line 563 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x01001810) line 508 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001c0306, unsigned int 49451, unsigned int 0, 
long 16783376) line 1018 + 9 bytes
USER32! 77e71820()
01001810()


Reproduced 4 times consistently in windows. In linux it crashes with out a core 
file. assigning to don, since he can figure where this goes.

Comment 5

[Radha on family leave (not reading bugmail)]

see the same behavior with wired.com

Comment 6

[don]

Travis, any clue as to who should get this from the stack crawl?

Comment 7

[travis]

Should be fixed.

Comment 8

[Richard Zach]

No longer crashing on Linux build 2000.04.16.06, either on theonion or wired.