422375 - FF3B4 crashes (Unhandled exception at 0x60abd4e8 (xul.dll)) if the second tabs location/url is written by hand and then closing the browser

Status: VERIFIED DUPLICATE of bug 421303

(Firefox :: Tabbed Browser, defect)

Description

[IlkkaP]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9b4) Gecko/2008030714 Firefox/3.0b4

This is new to Beta 4.. it did not happen with FF3B3.
Now, whenever I open a second tab and paste or write an url on the second tab and try to close FF, after selecting quit from the "Save.." dialog box, the FF crashes and pops up the crash reporter.
It does not happen when selecting the url from bookmarks.Nor does the "open link in a new tab". It happens only (?) when the url is written or pasted + enter and then closed both tabs open.
The browser works fine

Reproducible: Always

Steps to Reproduce:
1. Open FF3B4
2. Navigate to any url in the main window
3. Open a new tab
4. Write or paste any url in the new tab. Hit enter and wait that the page loads.
5. Close FF from the X
6. FF asks to save.. click Quit
7. Crash
Actual Results:  
Crash reporter kicks in

Expected Results:  
Silence

I get this callstack from the dump:

>	xul.dll!JVM_MaybeStartupLiveConnect()  + 0x71b9 bytes	
 	[Frames below may be incorrect and/or missing, no symbols loaded for xul.dll]	
 	xul.dll!gfxPDFSurface::gfxPDFSurface()  + 0x2641 bytes	
 	js3250.dll!JS_IsAboutToBeFinalized()  + 0xd28b bytes	
 	js3250.dll!JS_GC()  + 0x30 bytes	
 	xul.dll!gfxTextRun::AccumulateMetricsForRun()  + 0x2c72 bytes	
 	0012c5e0()	
 	xul.dll!NS_CycleCollectorSuspect_P()  + 0x8540 bytes	
 	df48d854()

Comment 1

[timeless]

http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg

Comment 2

[IlkkaP]

Yes.. here's the stack trace:

>	xul.dll!jsds_ScriptHookProc(JSDContext * jsdc=0x03c621f0, JSDScript * jsdscript=0x06f4bd80, int creating=0, void * callerdata=0x00000000)  Line 716 + 0x14 bytes	C++
 	xul.dll!_jsd_DestroyScriptHookProc()  + 0x70 bytes	C
 	js3250.dll!__SEH_epilog4()  + 0xc26a bytes	C
 	js3250.dll!_JS_GC()  + 0x30 bytes	C
 	xul.dll!nsXPConnect::Collect()  Line 527	C++
 	xul.dll!nsCycleCollector::Collect(unsigned int aTryCollections=5)  Line 2191 + 0x5 bytes	C++
 	xul.dll!nsCycleCollector_shutdown()  Line 2850	C++
 	xul.dll!NS_ShutdownXPCOM_P(nsIServiceManager * servMgr=0x00a5b044)  Line 780	C++
 	xul.dll!ScopedXPCOMStartup::~ScopedXPCOMStartup()  Line 905	C++
 	xul.dll!XRE_main(int argc=1, char * * argv=0x00a130a0, const nsXREAppData * aAppData=0x00a194c0)  Line 3195	C++


The offending source part is this:

JS_STATIC_DLL_CALLBACK (void)
jsds_ScriptHookProc (JSDContext* jsdc, JSDScript* jsdscript, JSBool creating,
 
                    void* callerdata)
                     

{

#ifdef CAUTIOUS_SCRIPTHOOK

    JSContext *cx = JSD_GetDefaultJSContext(jsdc);

    JSRuntime *rt = JS_GetRuntime(cx);

#endif


    nsCOMPtr<jsdIScriptHook> hook;

--->    gJsds->GetScriptHook (getter_AddRefs(hook));  <------ hook.nsCOMPtr_base = {mRawPtr=0x00000000 } Access Violation
    
    if (creating) {
 
       /* a script is being created */

        if (!hook) {
 
           /* nobody cares, just exit */
 
           return;
        }

Comment 3

[IlkkaP]

The exception seems to come from  jsdService::EnumerateScripts(jsdIScriptEnumerator *):

60ABD4DA  mov         dword ptr [hook],ebx 
60ABD4DD  call        nsCOMPtr<nsIAutoCompleteSearch>::StartAssignment (60A11BEFh) 
60ABD4E2  mov         ecx,dword ptr [jsdContext::LastTag+4 (60D656E8h)] 
60ABD4E8  mov         edx,dword ptr [ecx] <---- ecx=0x00000000

And, in the above source, the gJsds is null. The parameters are ok.

Comment 4

[timeless]

I'm assuming your build id is correct.

this should be fixed in a build like 2008031014 or later.

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified dup