337259 - crash when left-clicking links with target=_blank

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[pal-moz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060508 BonEcho/2.0a2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060508 BonEcho/2.0a2 ID:2006050823

[example]
http://forums.mozillazine.org/viewtopic.php?t=414203

regresshin between 2006050803 and 2006050823
[range]
http://tinderbox.mozilla.org/bonsai/cvsquery.cgi?treeid=default&module=all&branch=MOZILLA_1_8_BRANCH&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-05-08+03%3A00%3A00&maxdate=2006-05-08+23%3A00%3A00&cvsroot=%2Fcvsroot

Reproducible: Always

Steps to Reproduce:
1.click Bug#
2.CRASH with no dialog, no QFA/TB
3.

Comment 1

[John Hanna]

If this helps, it also happens with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060508 <strong>BonEcho/2.0a1 ID:2006050821</strong>

Comment 2

[pal-moz]

talkback is disabled (maxversion still 2.0a1)

http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB18469427G

Comment 3

[Peter van der Woude [:Peter6]]

an option to set ? 2.0a2 would have been usefull

Comment 4

[Ben Fowler]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060509 Minefield/3.0a1

Using the link to Community:Bug_Day at the top of the page you linked to, the page opened in a new tab (no crash).

Am I missing a part of your recipe?

Comment 5

[John Hanna]

(In reply to comment #4)
> Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060509
> Minefield/3.0a1
> 
> Using the link to Community:Bug_Day at the top of the page you linked to, the
> page opened in a new tab (no crash).
> 
> Am I missing a part of your recipe?
> 
Maybe that it's a Windows build bug.

Comment 6

[pal-moz]

(In reply to comment #4)
> Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060509
> Minefield/3.0a1

BUG on Bon Echo, not on Minefield.

Comment 7

[u88484]

This should definently block alpha 2.

Added keyword: zt4newcrash, About as close as it gets to a keyword needed to block.

Comment 8

[Guy Kaiser]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060508 BonEcho/2.0a1 ID:2006050803

I can't reproduce this one... Am I missing something? 

I clicked every bug # on that page and BonEcho didn't die once.

Comment 9

[Guy Kaiser]

(In reply to comment #8)
> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060508
> BonEcho/2.0a1 ID:2006050803
> 
> I can't reproduce this one... Am I missing something? 
> 
> I clicked every bug # on that page and BonEcho didn't die once.
> 
NM... Apparently I missed "2.0a2." My apologies. 

Comment 10

[pal-moz]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1a2) Gecko/20060509 BonEcho/2.0a2 ID:2006050905

no matter which you set to "new windows" or to "new tabs in..." (Options>tabs>Open links...)

to open links 
by middle-click : NO Crash
by left-click : CRASH

Comment 11

[Mike Beltzner [:beltzner, not reading bugmail]]

(In reply to comment #3)
> an option to set ? 2.0a2 would have been usefull

Set blocking-firefox2? and put the target milestone at Firefox 2 alpha 2.

Comment 12

[Guy Kaiser]

(In reply to comment #10)
> to open links 
> by middle-click : NO Crash
> by left-click : CRASH
> 
In addition (in case it matters)...
Right-Click + Open Link in New Tab will NOT cause a crash.
Right-Click + Open Link in New Window will NOT cause a crash.

Comment 13

[:Gavin Sharp [email: [e-mail]]]

Attachment: stack

Comment 14

[:Gavin Sharp [email: [e-mail]]]

url is null at:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/dom/src/base/nsGlobalWindow.cpp&rev=1.761.2.34&mark=6041#6035

Comment 15

[Mike Schroepfer]

Over to deakin since this appears to be Storage related.

Comment 16

[Boris Zbarsky [:bzbarsky]]

This probably also crashes on 

  javascript:window.open()

if I understand the stack correctly...

Comment 17

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #16)
> This probably also crashes on javascript:window.open()

Yes, it does.

Comment 18

[Neil Deakin]

Attachment: Check for null url

I think this is the right fix, but haven't been able to test it.

Comment 19

[Mike Beltzner [:beltzner, not reading bugmail]]

retargetted at beta 1

Comment 20

[Doug Halamay]

(In reply to comment #18)
> Created an attachment (id=221473) [edit]
> Check for null url
> 
> I think this is the right fix, but haven't been able to test it.
> 

I can confirm that this patch fixes the problem...

Comment 21

[Boris Zbarsky [:bzbarsky]]

*** Bug 337328 has been marked as a duplicate of this bug. ***

Comment 22

[u88484]

(In reply to comment #19)
> retargetted at beta 1
> 

Mike, are you serious? A release is gonna ship with such a noticeable crasher? Granted it's only an Alpha but come on. I could understand a crash that only happens if you click this, then minimize window, then open options menu...whatever...but this is such an easy to reproduce crash and will be the top crasher. There should be a respin to get that patch in if it fixes the problem. 

Comment 23

[Boris Zbarsky [:bzbarsky]]

Kurt, the bug that caused this crash is being backed out of the branch.  Please see .planning.

Comment 24

[u88484]

(In reply to comment #23)
> Kurt, the bug that caused this crash is being backed out of the branch.  Please
> see .planning.
> 

Thanks borris, had not had a chance to read the minutes yet and didn't see it say in this bug that there was going to be a backout that would fix this.

Comment 25

[u127172]

I get the same issue with MacOS X build.

Go to http://forums.mozillazine.org/viewtopic.php?t=414615 then left-click on "ATLANTIA (Mac)" link => Firefox crashes.

Build ID : Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1a2) Gecko/20060509 BonEcho/2.0a2 ID:2006050907

Comment 26

[John Hanna]

(In reply to comment #25)
> I get the same issue with MacOS X build.
> 
> Go to http://forums.mozillazine.org/viewtopic.php?t=414615 then left-click on
> "ATLANTIA (Mac)" link => Firefox crashes.
> 
> Build ID : Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1a2)
> Gecko/20060509 BonEcho/2.0a2 ID:2006050907
> 

The good news is that this is now fixed on Windows
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1a2) Gecko/20060509 BonEcho/2.0a2 ID:2006050921

Comment 27

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

*** Bug 337402 has been marked as a duplicate of this bug. ***

Comment 28

[timeless]

Comment on attachment 221473 [details] [diff] [review]
Check for null url

arg, i've tried to write this comment before. my networks don't like me.

please use !url.IsEmpty() instead of .get().

Comment 29

[Neil Deakin]

The patch that caused this has been backed out, so no not blocking anything anymore.

Comment 30

[Johnny Stenback (:jst)]

Comment on attachment 221473 [details] [diff] [review]
Check for null url

r+sr=jst, but how about just sticking the url.get() check in the containing if (newDocShell && thisWebNav) check instead of having a nested if checking for that only?

Comment 31

[Neil Deakin]

Fixed by recheckin of storage

Comment 32

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

If this is now fixed on the 1.8 branch, could somebody add fixed1.8.1 or remove the blocking1.8.1? nomination, whichever is more appropriate?

Comment 33

[Stephanie Daugherty [:sdaugherty]]

verifying as fixed, doesn't crash for me with the testcase in newest nightly, do we need a test to make sure this doesn't happen again? can we test for this anywhere other than litmus?
-> verified