35794 - javascript: url crashes in nsStreamIOChannel::OnStopRequest()

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[Simon Fraser [no longer active]]

Any javascript: url is crashing for me now, with the following stack:

  00000000    PPC  1F3B6C34  
  08B21B00    PPC  1F3A1630  main+00240
  08B21A60    PPC  1F39FC14  main1(int, char**, nsISplashScreen*)+00810
  08B21960    PPC  1E521A60  nsAppShellService::Run()+00054
  08B21910    PPC  1E3F5048  nsAppShell::Run()+00040
  08B218D0    PPC  1E3F58F8  nsMacMessagePump::DoMessagePump()+00044
  08B21880    PPC  1E3F5FE8  nsMacMessagePump::DispatchEvent(int, EventRecord*)+
001B0
  08B21830    PPC  1F41FA24  Repeater::DoRepeaters(const EventRecord&)+0003C
  08B217E0    PPC  1E3CEE70  nsMacNSPREventQueueHandler::RepeatAction(const 
EventRecord&)+00014
  08B217A0    PPC  1E3CF14C  nsMacNSPREventQueueHandler::ProcessPLEventQueue()+
00274
  08B21710    PPC  1CD25B7C  nsEventQueueImpl::ProcessPendingEvents()+00068
  08B216A0    PPC  1CD9C890  PL_ProcessPendingEvents+00084
  08B21650    PPC  1CD9C9D4  PL_HandleEvent+00054
  08B21610    PPC  1CA05610  nsStreamListenerEvent::HandlePLEvent(PLEvent*)+00050
  08B215D0    PPC  1CA06CBC  nsGetServiceByCID::~nsGetServiceByCID()+00708
  08B21580    PPC  1CA33BD0  nsStreamIOChannel::OnStopRequest(nsIChannel*, 
nsISupports*, unsigned int, const unsigned short*)+000DC

The nsStreamIOChannel in that last stack frame has been deleted already.

Comment 1

[Simon Fraser [no longer active]]

This is a blocker.

Comment 2

[Andreas Franke (gone)]

*** Bug 35769 has been marked as a duplicate of this bug. ***

Comment 3

[Andreas Franke (gone)]

The above "duplicate" (bug 35769) has a different stack trace,
but it also started with today's build.
Please try to verify it also when this bug is fixed.

Comment 4

[Warren Harris]

Refcounting bug in the js protocol. Fixed.

Comment 5

[leger]

Adding crash keyword

Comment 6

[Tom Everingham]

verified:  Mac8.6 2000041810
NT 2000042009
Linux 2000042609