340688 - Crash submitting a form with the target attribute set [@ JS_GetOptions]

Status: RESOLVED DUPLICATE of bug 340651

(Core :: DOM: Core & HTML, defect)

Description

[Ryan Jones-Ward [:sciguyryan]]

When submitting a form with the target attribute set Firefox crashes. Please see simplified testcase included.

Tested on trunk build and is always reproducible.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060607 Minefield/3.0a1 - Build ID: 2006060704

Also have 2 talkback ID's for the crashes:

TB19606560G TB19606524X

Comment 1

[Ryan Jones-Ward [:sciguyryan]]

Attachment: Simple Testcase

Included is the simple testcase, just a form and a submit button.

Comment 2

[Ryan Jones-Ward [:sciguyryan]]

This worked in yesterdays build so maybe its a regression?

Comment 3

[Ria Klaassen (not reading all bugmail)]

This looks like the same crash as bug 340651.
You get it on various occasions; clicking Help > About Minefield, or when you click OK on an alert, or when you paste an URL in the location bar. Not always but in 50% of the cases.

Comment 4

[Phil Ringnalda (:philor)]

And like bug 340651, seems likely to actually be bug 340602.

Comment 5

[Adam Guthrie]

Incident ID: 19606524
Stack Signature	JS_GetOptions c3a13203
Product ID	FirefoxTrunk
Build ID	2006060704
Trigger Time	2006-06-07 09:28:21.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (00001595)
URL visited	
User Comments	
Since Last Crash	20 sec
Total Uptime	3406 sec
Trigger Reason	Access violation
Source File, Line No.	c:\builds\tinderbox\fx-trunk-cairo\winnt_5.2_depend\mozilla\js\src\jsapi.c, line 1049
Stack Trace 	
JS_GetOptions   IsContextOnStack   nsCxPusher::Push   nsCxPusher::nsCxPusher   

Comment 6

[timeless]

*** This bug has been marked as a duplicate of 340651 ***